ASP.NET WEB API 自定义模型校验过滤器

　　对外公开WEB接口时，对模型校验是常见的安全常识，常见的写法是在controller中判断ModelState.IsValid，以注册用户API为例。

Model:

public class RegisterCustomerModel
{
        [Required(ErrorMessage = "姓名不能为空")]
        [StringLength(,ErrorMessage = "姓名长度不能超过10个字")]
        public string Name { get; set; }

        [Required(ErrorMessage = "电话不能为空")]
        [RegularExpression(@"^1[34578]\d{9}$", ErrorMessage = "电话号码格式不正确")]
        public string Phone { get; set; }

        [Required(ErrorMessage = "密码不能为空")]
        [StringLength(, ErrorMessage = "密码长度不能超过48个字符")]
        public string Password { get; set; }

}

打印校验失败的错误消息代码：

public static class ModelStateExtension
   {
        public static string ToErrorMessage(this ModelStateDictionary modelStateDictionary)
        {
            var stringBuilder = new StringBuilder();

            foreach (var value in modelStateDictionary.Values)
            {
                foreach (var error in value.Errors)
                {
                    stringBuilder.AppendLine(error.ErrorMessage);
                }
            }

            return stringBuilder.ToString();
        }
   }

Controller:

public ResponseProtocol Register(RegisterCustomerModel registerCustomerModel)
  {
            if (!ModelState.IsValid)
            {
                return new ResponseProtocol((int)ResponseResultEnum.ValidateError, ModelState.ToErrorMessage(), string.Empty);
            }

            Customer customer = new Customer
            {
                Name = registerCustomerModel.Name,
                Phone = registerCustomerModel.Phone,
                WeiXinNo = registerCustomerModel.WeiXinNo,
                Company = registerCustomerModel.Company,
                UpdateTime = DateTime.Now
            };

            _customerService.Add(customer);

            return new ResponseProtocol((int)ResponseResultEnum.Success, "注册成功", string.Empty);
    }

　　以上写法是在controller里进行校验，缺点是每个需要进行校验的controller都要写一次，为了消除重复，可以将校验代码写入全局过滤器中，由过滤器进行统一模型校验，修改后的代码：

public class ValidationModelFilter : ActionFilterAttribute
    {
        public override void OnActionExecuting(HttpActionContext actionContext)
        {
            //get方法不进行模型校验
            if (actionContext.Request.Method.Method=="GET")
            {
                return;
            }

            if (!actionContext.ModelState.IsValid)
            {
                var error = JsonConvert.SerializeObject(new ResponseProtocol()
                {
                    Code =(int)ResponseResultEnum.ValidateError,
                    Message = actionContext.ModelState.ToErrorMessage(),
                    Data = string.Empty
                });

                var httpResponseMessage = new HttpResponseMessage
                {
                    Content = new StringContent(error)
                };

                httpResponseMessage.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
                actionContext.Response = httpResponseMessage;
            }
        }
    }

　　然后在全局过滤器（WebApiConfig）注册一下： config.Filters.Add(new ValidationModelFilter());