asp.net中是否存在拒绝访问方法的一个用户或角色的注释？

Question

I guess if in asp.net mvc exixts possibility to exclude some user from access to an action method.

As well the "authorize" annotazion allows users to acces some action methods:

[Authorize(Users="*")]   
public ActionResult method1() { ... }

a similar annotation for exclude, for example:

[Deny(Users="user1")]        
public ActionResult method1() { ... }

Answer 1

I don't think there is, but you can create a custom AuthorizeAttribute as simple as this:

public class DenyAttribute : AuthorizeAttribute
{
   private string[] deniedusers;  
   public CustomAuthorizeAttribute(params string[] users)  
   {  
      this.deniedusers = users;  
   }  
   protected override bool AuthorizeCore(HttpContextBase httpContext)  
   {  
      // you could improve this
      return !this.deniedusers.Contains(httpContext.User.Identity.Name);  
   }  
}

Or a simpler solution:

public class DenyAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        return !base.AuthorizeCore(httpContext);
    }
}

Then you will be able to use it exactly as in your example:

[Deny(Users="user1,user2")]