ASP.Net MVC 3允许匿名白名单不起作用

Question

I took over an MVC 3 Razorview project from a colleague. I created a forgotten password page, however when clicking on the forgotten password link on the Log on page, the website asks the user to log in. I did some googling and implemented the solution for white listing actions using the [AllowAnonymous] attribute. However this did not resolve the issue.

Stepping through the code the forgotten password action is never called. It is pushed straight to the LogOn action on the Account Controller. The _ViewStart.cshtml has the following code which is called even though the forgotten password layout doesn't use it and has a layout set in the code.

@{
    Layout = Request.IsAuthenticated ? "~/Views/Shared/_Layout.cshtml" : null;
}

Answer 1

You have to include all the action methods of the controller, that are used in the view, in the white list(using [AllowAnonymous]). I had the same issue with a RecoverPassword page and I realized that my layout invoked a menu method that wasn't in the white list.

Answer 2

You can try this. http://blog.tomasjansson.com/2011/08/securing-your-asp-net-mvc-3-application/

UPDATE

The following code works fine. It implements the OnAuthorization in the base class itself.

public class MyBaseController : Controller
{
    protected override void OnAuthorization(AuthorizationContext filterContext)
    {
        var skipAuthorization = filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true) ||
                            filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(
                                typeof(AllowAnonymousAttribute), true);
        if (!skipAuthorization)
        {
            base.OnAuthorization(filterContext);
            if (!User.Identity.IsAuthenticated)//Implement your own logic here
            {
                var url = new UrlHelper(filterContext.RequestContext);
                var logonUrl = url.Action("LogOn", "Home", new { reason = "NotAuthorized" });
                filterContext.Result = new RedirectResult(logonUrl);

            }
        }

    }
}

public class HomeController : MyBaseController 
{

    public ActionResult Index()
    {
        return View();
    }

    [AllowAnonymous]
    public ActionResult PasswordReset()
    {
        return Content("reset your password");
    }

    [AllowAnonymous]
    public ActionResult LogOn(string reason)
    {
        return Content("please log in");
    }
}

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = true, Inherited = true)]
public class AllowAnonymousAttribute : Attribute
{
}