首先,添加一个类AuthenticationAttribute,该类继承AuthorizeAttribute,如下:
class="code_img_closed" src="/Upload/Images/2017080222/0015B68B3C38AA5B.gif" alt="">using System.Web; using System.Web.Mvc; namespace Zhong.Web { public class AuthenticationAttribute : AuthorizeAttribute { public override void OnAuthorization(AuthorizationContext filterContext) { //base.OnAuthorization(filterContext); //如果控制器没有加AllowAnonymous特性或者Action没有加AllowAnonymous特性才检查 if (!filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute),true) && !filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute),true)) { //此处写判断是否登录的逻辑代码 //这里使用cookie来判断是否登录,为了简单说明特性的使用方式,cookie记录的是用户名和明文密码(实际当中需要经过诸如加密等处理) HttpCookie cookie = filterContext.HttpContext.Request.Cookies["Member"]; if (!(cookie!=null && cookie.Values["name"] == "test" && cookie.Values["pass"] == "123")) { filterContext.Result = new RedirectResult("/Member/Login"); } } } } }logs_code_collapse">View Code
在MemberControll中加上特性Authentication,Member控制器下有三个Action方法,一个是首页Index,一个是登录页Login,一个是处理Post方式的登录页Login,Index对应的视图代码如下:
@{ ViewBag.Title = "Index"; } <h2>这是会员中心</h2>
Login对应的视图代码如下:
@{ ViewBag.Title = "Login"; } <h2>会员登录</h2> @using (Html.BeginForm()) { <label>用户名:</label><input type="text" name="name" /><br /> <label>密码:</label><input type="password" name="password" /><br /> <input type="submit" value="登录" /> }
当没有登录直接访问Member/Index时,会跳转到Login。当输入正确的用户名密码登录时,会跳转到Index页面。
完整的MemberController代码如下:
using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc; namespace Zhong.Web.Controllers { [Authentication] public class MemberController : Controller { // GET: Member public ActionResult Index() { return View(); } [AllowAnonymous] public ActionResult Login() { return View(); } [AllowAnonymous] [HttpPost] public ActionResult Login(string name,string password) { //这里为了简单演示一下登录的判断,主要是验证AuthenticationAttribute的作用,实际的运用中可能要查询数据库、 //密码判断需要加密处理等 if (name == "test" && password == "123") { HttpCookie cookie = new HttpCookie("Member"); cookie.Values["name"] = "test"; cookie.Values["pass"] = "123"; Response.Cookies.Add(cookie); return RedirectToAction("Index"); } return View(); } } }View Code
特别说明:由于控制器使用了Authentication特性,所以请求其下的所有Action都要先通过授权/登录 验证,Login是登录页面,访问这个页面一般是没有登录的状态,所以需要允许匿名访问,于是加了[AllowAnonymous]
上面的AuthorizationAttribute的另一种写法是继承FilterAttribute 并实现接口IAuthorizationFilter,方式与系统的AuthorizeAttribute类似,
using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc; namespace Zhong.Web { public class TestAttribute : FilterAttribute, IAuthorizationFilter { public void OnAuthorization(AuthorizationContext filterContext) { //throw new NotImplementedException(); //TODO: 此处写需要实现登录验证的代码 } } }View Code