c# - 如何在自定义 AuthorizeAttribute 中允许 [Authorize]

Question

我有一个像这样的自定义 AuthorizeAttribute

public class DevMode : AuthorizationFilterAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        if (myConditionToAuthorize)
        {
            // how to allow [Authorize] ?
        }
    }
}

问题在于它与 [Authorize] 标签一起使用，如下所示:

[Authorize, DevMode]
public class UserController : ApiController { ... }

我需要在 [DevMode] 中允许 [Authorize] == true

或者最好将它们放在一个唯一的授权类中？但是后来我不知道要检查授权数据。

Answer 1

Or it is better to put them all together inside a unique authorize class?

哦，是的，那确实会更好。您可以简单地从 AuthorizeAttribute 派生并调用基本方法:

public class DevModeAttribute : AuthorizeAttribute
{
    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var authorize = base.IsAuthorized(actionContext);
        if (!authorized)
        {
            // the user is not authorized, no need to go any further
            return false;
        }

        // now apply your custom authorization logic here and return true or false
        ...
    }
}

然后:

[DevMode]
public class UserController : ApiController { ... }