MVC自定义授权数据库属性

Question

I made my own custom Role table in my database and I wanted to also create a custom authorize attribute along with it.

Here is what I have so far, but I'm not really sure how to proceed:

    private List<RoleModel> Roles;
    private IRoleRepository repo;
    private ICustomerRepository cust;


    public bool CheckRoles(string UserId)
    {
        try
        {
            Roles = repo.GetAll().ToList();
            CustomerModel Customer = cust.Get(UserId);
            int CustomerRole = Customer.RoleId;
            RoleModel role = Roles.First(x => x.id == CustomerRole);


        }
        catch(Exception e)
        {
            return false;
        }
    }

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);
        string UserId = filterContext.HttpContext.User.Identity.GetUserId();



    } 

If anyone can help me finish this I would greatly appreciate it.

Thanks!

Answer 1

I think that create a custom AuthorizeAttribute is not a good idea. It is a good practice to use the standard AuthorizeAttribute.

It is a common case to have its own Role table. It is better to override how to set the roles of the identity of your principal and to use the Roles property of AuthorizeAttribute. Set the role as a claim once when the user is logging; it will be better than retrieve the role from database in the custom Authorize attribute at each request. Set your claim CalimTypes.Role, and then protect your controllers/actions with :

[Authorize(Roles = "admin")]