使用特定规则创建自定义Authorize属性

Question

I'm trying to create a custom Authorize attribute to do the following:

1. If the user has a role of "Regular user" - he is redirected to /index/subscribe
2. All other users(Administrator,Subscriber) gets access to /Search/Index

This is when the user tries to open up the Search controller. I made the custom Authorize attribute like this:

public class DenyRegularUser : System.Web.Mvc.AuthorizeAttribute
    {
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            base.OnAuthorization(filterContext);
            if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
                filterContext.Result = new RedirectResult("~/User/Logon");
                return;
            }

            if (filterContext.HttpContext.User.IsInRole("Regular user"))
            {
                filterContext.Result = new RedirectResult("~/Index/Subscribe");
            }
        }
    }

And this is my Search controller:

namespace WebApplication2.Controllers
{
    [DenyRegularUser(Roles ="Regular user")]
    public class SearchController : Controller
    {
        // GET: Search
        public ActionResult Index()
        {
            return View();
        }
    }
}

But for some reason, even when I update the user's role from Regular user to Administrator or Subscriber, I get redirected to login page: /user/login...

This shouldn't happen as the login functionality works perfectly and I get the role of the user...

What am I missing out here??

Answer 1

This may help.

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)]
public class DenyRegularUser  : AuthorizeAttribute
{
    public DenyRegularUser() :
        base()
    {

    }

    protected override bool IsAuthorized (System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        if (AuthorizeRequest(actionContext))
        {
            return true;
        }
        return false;
    }

    protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        //Code to handle unauthorized request
        actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.TemporaryRedirect);
        actionContext.Response.Headers.Add("Location", "~/Index/Subscribe");
    }

    private bool AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        //Write your code here to perform authorization
    }
}

I believe the IsAuthorized method is the correct way to override the AuthorizeAttribute.