.NET Core中的鉴权授权正确方式(.NET5)

目录

• 一、简介
• 二、传统的授权方式
• 三、 .NET5中正确的鉴权方式
• 四、.NET5中角色授权
  • 1.单个角色访问权限
  • 2.“多个角色包含一个”权限
  • 3.“多个角色组合”权限
• 五、自定义策略授权

7.增加鉴权过滤器MyActionAuthrizaFilterAttribute.cs，实现IActinFilter，在OnActionExecuting中写鉴权逻辑

 public class MyActionAuthrizaFilterAttribute : Attribute, IActionFilter
    {
        public void OnActionExecuted(ActionExecutedContext context)
        {
            //throw new NotImplementedException();
        }
        /// 

        /// 进入action前
        /// 
        /// 
        public void OnActionExecuting(ActionExecutingContext context)
        {
            //throw new NotImplementedException();
            Console.WriteLine("开始验证权限...");
           // CurrentUser currentUser = context.HttpContext.GetCurrentUserBySession();
            CurrentUser currentUser = context.HttpContext.GetCurrentUserByCookie();
            if (currentUser == null)
            {
                Console.WriteLine("没有权限...");
                if (this.IsAjaxRequest(context.HttpContext.Request))
                {
                    context.Result = new JsonResult(new
                    {
                        Success = false,
                        Message = "没有权限"
                    });
                }
                context.Result = new RedirectResult("/Account/Login");
　　　　　　　　　　return;
            }
            Console.WriteLine("权限验证成功...");
        }
        private bool IsAjaxRequest(HttpRequest request)
        {
            string header = request.Headers["X-Requested-With"];
            return "XMLHttpRequest".Equals(header);
        }
    }

在需要鉴权的控制器或方法上加上这个Filter即可完成鉴权，这里在主页中加入鉴权，登录成功的用户才能访问 

8.如果要用Session,还要在startup.cs中加入Session

 public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllersWithViews();
            services.AddSession();

        }

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseSession();
            app.UseRouting();

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapDefaultControllerRoute();
            });
        }

到这里，传统的鉴权就完成了，下面验证一下效果。

转 https://www.cnblogs.com/wei325/p/15575141.html