使用 asp.net mvc的Filter来验证Forms(判断是否登录,角色权限以及错误处理)

asp.net mvc里的Filter真的是个很好的东西.

之前看教程每次看到讲解Filter的地方总有模糊.

今天在做测试项目的时候.管理员后台管理的时候.我在每个Action里都先验证了一下是否登录.

结果做了7,8个Action的时候发现这样是不是有点太累了?脑袋里马上灵光一闪.Filter不是有个内置验证身份的吗?

马上搜索,一翻查找之后才发现内置的这个身份验证是争对membership的.而我使用的Forms验证..

咋办..继续搜呗.功夫不负有心人..终于让我给找到了.经过测试,使用很不错.

7,8个action里的if (!Request.IsAuthenticated)终于可以变成一句了..这样我就可以更安心的写Action了.

不说了.贴代码.

先是自定义的 Filter:

using System;

using System.Data;

using System.Configuration;

using System.Linq;

using System.Web;

using System.Web.Mvc;

using System.Web.Security;

using System.Web.Routing;

namespace cml.web.Filters

{

///

/// 角色认证

///

public class VaildateLoginRoleAttribute : ActionFilterAttribute

{

///

/// 角色名称

///

public string Role { get; set; }

public override void OnActionExecuting(ActionExecutingContext filterContext)

{

if (!string.IsNullOrEmpty(Role))

{

if (!filterContext.HttpContext.User.Identity.IsAuthenticated)

{

string redirectOnSuccess = filterContext.HttpContext.Request.RawUrl;

string redirectUrl = string.Format("?ReturnUrl={0}", redirectOnSuccess);

string loginUrl = FormsAuthentication.LoginUrl + redirectUrl;

filterContext.HttpContext.Response.Redirect(loginUrl, true);

}

else

{

//判断是否存在角色

FormsIdentity id = (FormsIdentity)HttpContext.Current.User.Identity;

FormsAuthenticationTicket ticket = id.Ticket;

string roles = ticket.UserData;

string[] chkRoles = this.Role.Split(',');

bool isAuthorized = false;

if (Array.IndexOf(chkRoles, roles) > -1)

isAuthorized = true;

else

isAuthorized = false;

if (!isAuthorized)

filterContext.Result = new RedirectToRouteResult("Default", new RouteValueDictionary(new { controller = "Manage", action = "AdminLogin" }));

//throw new UnauthorizedAccessException("你没有权限访问该页面");

}

}

else

{

throw new InvalidOperationException("没有指定角色");

}

}

}

//错误验证

//public class ErrorAttribute : ActionFilterAttribute

//{

// public override void OnActionExecuted(ActionExecutedContext filterContext) // OnActionExecuted表示在Action执行之后

// {

// if (filterContext.Exception != null)

// {

// filterContext.ExceptionHandled = true;

// filterContext.Result = new RedirectToRouteResult("Default", new RouteValueDictionary(new { controller = "Shared", action = "Error" }));

// }

// }

//}

public class VaildateLogin : ActionFilterAttribute

{

public override void OnActionExecuting(ActionExecutingContext filterContext)

{

if (!filterContext.HttpContext.User.Identity.IsAuthenticated)

{

filterContext.Result = new RedirectToRouteResult("Default", new RouteValueDictionary(new { controller = "Manage", action = "AdminLogin" }));

}

}

}

}

FilterOK了..就去Controller里使用吧.

[VaildateLogin] //这里就是使用的Filter验证,记得在using里引用Filter的命名空间.

public ActionResult AddAdmin()

{

//if (!Request.IsAuthenticated) //这里是开始手动写的..多麻烦...

//{

// return RedirectToAction("AdminLogin");

//}

//else

//{

cml.BLL.Admin bll = new cml.BLL.Admin();

ViewData["list_model"] = bll.GetAdminList("", 1);

return View();

//}

}

怎么样.很方便吧.如果是整个Controller下都需要身份验证的话..那就把这个Filter放到最外层的Controller上..这样就不用在每个Action上都写了.

完工..希望多点人来学习asp.net mvc..要不然教程太少了.好东西也太少了.

from http://www.9aw.cn/post/2009/07/06/asp-net-mvc-Filter-Forms.aspx