加载方法，无论调用其他方法如何

Question

For example I have the following controller example.com/controller/

There are three methods:

• example.com/controller/method1
• example.com/controller/method2
• example.com/controller/validate

I want validate to run regardless of what ever method is called, I want to ensure validate runs because it contains the code to verify if client has the valid cookie set or boot them from the page.

Answer 1

I think you need ActionFilter which will do validation. Create your custom validation filter attribute, override its OnActionExecuting method (do cookie validation), and apply attribute to controller (or specific actions).

Answer 2

I would suggest looking at Action filters:

An action filter is an attribute that you can apply to a controller action -- or an entire controller -- that modifies the way in which the action is executed. The ASP.NET MVC framework includes several action filters:

• OutputCache – This action filter caches the output of a controller action for a specified amount of time.
• HandleError – This action filter handles errors raised when a controller action executes.
• Authorize – This action filter enables you to restrict access to a particular user or role.

You also can create your own custom action filters. For example, you might want to create a custom action filter in order to implement a custom authentication system. Or, you might want to create an action filter that modifies the view data returned by a controller action.

http://www.asp.net/mvc/tutorials/older-versions/controllers-and-routing/understanding-action-filters-cs

Answer 3

Depending on the timing of when you want to do this check, you can either put this in the constructor of your controller, or override OnActionExecuting from the base controller (typically AsyncController).

If you want to run this check on every controller, then I suggest you create a ControllerBase class that your other controllers can then inherit from.

Answer 4

You should move your validation code from the action to custom authorization filter. Unlike the action filters, the authorization filters are the ones that runs at first so you should use them for this kind of security check.

There is already a built-in authorization filter Authorize that does decent job and if you would like to create a custom one I would recommend to extend the Authorize attribute and override the required methods. The Authorize attribute does some work-around to avoid cache issue and that's why I recommend it.