javascript - 在自定义授权期间强制 ajax .fail() 来管理登录重定向

Question

在 MVC 应用程序中，我有一个 jQuery ajax post 到 Controller 中的方法:

function initFormForInsert(metodoLoadForm, nomeForm, divForm, widthForm, heightForm, metodoInsert) {
    blockPage();
    var request = $.ajax(
        {
            type: 'POST',
            url: getRootURL() + metodoLoadForm
        });

    request.done(function (data) {
    //alert(data);
    LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
});

request.fail(function (jqXHR, textStatus) {
        unblockPage();
        showErrorDialog("Error", textStatus);
    });
}

我可以通过某种方式强制 request.fail() 吗？

因为我使用全局过滤器对 Controller 中的所有方法进行授权(下面的代码)特别是，当我收到此 Ajax 帖子并且我的 session 变量为 null 时，我想抛出异常。

protected override bool AuthorizeCore(HttpContextBase httpContext) {
    try {
        UserToken cUt = httpContext.GetUser();
        if (cUt == null) {
            //session is null
            return false;
        }
        string request = httpContext.Request.Path;
        if (httpContext.Request.Path.LastOrDefault() == '/')
            request = httpContext.Request.Path.Remove(httpContext.Request.Path.Length - 1);
        if (cUt.DeniedActions.Contains(request.ToUpper())) {
            //user is not authorized
            return false;
        }
        return true;
    } catch (Exception) {
        return false;
    }
}

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) {
    UserToken cUt = filterContext.HttpContext.GetUser();
    if (cUt == null) {
        //session is null
        if (
            //filterContext.HttpContext.Response.StatusCode == 302 &&
            filterContext.HttpContext.Request.Headers["X-Requested-With"] == "XMLHttpRequest"
        ) {
            //filterContext.HttpContext.Response.Clear();
            filterContext.HttpContext.Response.StatusCode = 401;
        } else {
            filterContext.Result = new RedirectToRouteResult(
                new RouteValueDictionary(
                    new {
                        controller = "Login",
                        action = "Login"
                    })
            );
        }
    } 

我已经这样修改了 JavaScript 对话框:

function initFormForInsert(metodoLoadForm, nomeForm, divForm, widthForm, heightForm, metodoInsert) {
    blockPage();
    var request = $.ajax(
            {
                type: 'POST',
                url: getRootURL() + metodoLoadForm,
                statusCode: { 
                    200: function (data) {
                        //alert(200);
                   LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
                    }, 
                    401: function (jqXHR, textStatus, errorThrown) {
                        //alert(401);
                    hrefTo("/Login/Login") ;
                } 
               } 

            });

    //request.done(function (data) {
    //    //alert(data);
    //    LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
    //});

    request.fail(function (jqXHR, textStatus) {
        unblockPage();
        showErrorDialog("Errore inizializzando la form per inserimento ", textStatus);
    });

}

授权如下:

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    try
    {        
        UserToken cUt = httpContext.GetUser();

        if (cUt == null)
            //session is null
        {
            return false;

        }

        string request = httpContext.Request.Path;

        if (httpContext.Request.Path.LastOrDefault() == '/')
            request = httpContext.Request.Path.Remove(httpContext.Request.Path.Length - 1);

        if (cUt.DeniedActions.Contains(request.ToUpper()))
        {
            //user is not authorized
            return false;
        }

        return true;

    }
    catch (Exception)
    {
        return false;
    }
}

protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
    UserToken cUt = filterContext.HttpContext.GetUser();

    if (cUt == null)
    {
        // session is null                
        if (filterContext.HttpContext.Request.Headers["X-Requested-With"] == "XMLHttpRequest")
        {
            filterContext.HttpContext.Response.TrySkipIisCustomErrors = true;
            filterContext.HttpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
            filterContext.HttpContext.Response.End();
            return;
        }
        else
        {
            filterContext.Result = new RedirectToRouteResult(
                    new RouteValueDictionary(
                        new
                        {
                            controller = "Login",
                            action = "Login"
                        })
                    );
        }
    }
}

你觉得可以吗？

或者另一种方法，即使速度较慢，也可以在 if 分支中添加检查 session 变量

   blockPage();
    if (checkSessionVariable()) {
        hrefTo("/Login/Login");

    }
    else {
        var request = $.ajax(
                {
                    type: 'POST',
                    url: getRootURL() + metodoLoadForm,


                });

        request.done(function (data) {
            //alert(data);
            LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
        });

        request.fail(function (jqXHR, textStatus) {
            unblockPage();
            showErrorDialog("Errore inizializzando la form per inserimento ", textStatus);
        });
    }

其中检查 session 变量是另一篇检查 session 变量的帖子

function checkSessionVariable() {

    var request = $.ajax(
    {
        type: 'POST',
        url: getRootURL() + "/Login/SessionExpired"
    });

    request.done(function (data) {
        return (data);
    });

    request.fail(function (jqXHR, textStatus) {

        return 0;
    });

}

也许这是一个更可靠的解决方案？

Answer 1

不建议提供 500 或 403 错误作为解决方法。请记住，这些是状态代码，表示未找到资源的 N/w 失败

相反，尝试将服务器的结果处理为带有负面场景的正面响应这意味着现在需要按如下方式处理数据

request.done(function (data) {
        //alert(data);
        if(data.positive) {
LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
}
 else if(data.negative){
unblockPage();
        showErrorDialog("Error", textStatus);
}
    });

例如，您也可以传递 cookie(下面是伪代码)

request.done(function (data) {
            //alert(data);
            if(cookie == "positive") {
    LoadFormForInsert(data, nomeForm, divForm, widthForm, heightForm, metodoInsert);
    }
     else if(cookie == "negative"){
    unblockPage();
            showErrorDialog("Error", textStatus);
    }
        });