除了指定的例外，如何拒绝角色/用户对所有控制器/操作的访问asp.net MVC

Question

I would like to be able to specify either a role a user that isn't allowed to access and entire site when all other users are.

I would then like to be able to do something along the lines of an authorize header on selected actions so that the denied user is still allowed access this selected action and controller if possible.

I know I could create a role, add all other users to this role and then do an authorization attribute on this role but this would have to be done on every single action which is a non-starter because the project is already built with hundreds if not thousands of actions.

So any suggestions will be appreciated

Answer 1

The easiest solution here would probably be a custom Authorize attribute to add Deny functionality. You could implement this in a number of ways. For instance, you could deny based on a specific role, but that can be difficult to maintain over time if you want to deny people from different parts of the app, you'd have to create different roles and change your code every time you want to do that.

For example:

public class DenyAttribute : AuthorizeAttribute 
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        return !base.AuthorizeCore(httpContext);
    }
}

This uses the Roles property of the AuthorizeAttribute as a deny.

[Deny(Roles="DeniedUsers")]

Be aware though, that you would need some kind of higher level authorization, such as at the Controller or global filter level that blocks overall unauthenticated users, otherwise it would allow anyone not in the Role specified to have access, including unauthenticated users. So maybe add something like:

return httpContext.User.IsAuthenticated && !base.AuthorizeCore(httpContext);

Also be aware that using this in conjunction with an [AllowAnonymous] might be problematic.

Another option would be to create a more flexible system that would calculate the deny based on the current controller/action. Something like this:

public class DenyByControllerActionAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var controller = httpContext.Request.RequestContext.RouteData.GetRequiredString("controller");
        var action = httpContext.Request.RequestContext.RouteData.GetRequiredString("action");
        var denyRole = string.Format("Deny{0}:{1}", controller, action);
        return !httpContext.User.IsInRole(denyRole) && base.AuthorizeCore(httpContext);
    }
}

Which you can then control access by adding the user to a role of the format "Deny{Controller}:{Action}", so something like DenyHome:Index or "DenyAdmin:Email".

This will also require they have Default authorize access as well by calling the base AuthorizeCore functionality. So, you can do a wholesale replace of [Authorize] with `[DenyByControllerAction] and it will work the same way (or use it as a global filter), but simply adding the role you can deny any user access to any Controller/Action.