MVC扩展Filter, 通过继承AuthorizationAttribute限制IP

为什么需要AuthorizationAttribute

在没有Authorization系统属性之前，我们可能这样判断：
Request.IsAuthenticated && User.Identity.IsAuthenticated来判断请求是否有权限。

有了Authorization系统属性之后，我们可能这样：
[Authorize]
public ActionResult SomeAction()

在Web.config文件中：
<authentication mode="Forms">
    <forms loginUrl="~/Home/UnAuthorized" timeout="2880" />
</authentication>

很显然，有了AuthorizeAttribute这种cross-cutting设计，简化了代码，降低了耦合。

通过继承AuthorizationAttribute来扩展

主要是重写AuthorizeCore方法。

public class SomeAuthorizationAttribute : AuthorizeAttribute

{

    private List<string> blockIps;

    protected override bool AuthorizeCore(HttpContextBase httpContext)

    {

        LoadBockIpAddresses();

        return (!blockIps.Contains(httpContext.Request.UserHostAddress));

    }

    public void LoadBlockIpAddresses()

    {

        blokedIps = new List<string>();

        blockedIps.Add("127.0.0.1");

    }

}

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }

使用默认的AuthorizeAttribute

[Authorize(Users="", Roles="")]
public ActionResult SomeAction

同时需要在Web.config中配置：

<authentication mode="Forms">

  <forms loginUrl="~/Home/UnAuthorized" timeout="2880">

    <credentials>

      <user name="name" password="name"/>

    </credentials>

  </forms>

</authentication>

<roleManager enabled="true" cacheRolesInCookie="true" />

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, "Courier New", courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }

参考资料：
MVC Filters Part 1 - Authorization Filter