1.权限控制使用controller和 action来实现,权限方式有很多种,最近开发项目使用控制控制器方式实现代码如下
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
/// <summary>
/// 用户权限控制
/// </summary>
public class UserAuthorize : AuthorizeAttribute
{
/// <summary>
/// 授权失败时呈现的视图
/// </summary>
public string AuthorizationFailView { get ; set ; }
/// <summary>
/// 请求授权时执行
/// </summary>
/// <param name="filterContext">上下文</param>
public override void OnAuthorization(AuthorizationContext filterContext)
{
// 获取url请求里的 controller 和 action
string controllerName = filterContext.RouteData.Values[ "controller" ].ToString();
string actionName = filterContext.RouteData.Values[ "action" ].ToString();
// 获取用户信息
UserLoginBaseInfo _userLoginInfo = filterContext.HttpContext.Session[Property.UerLoginSession] as UserLoginBaseInfo;
//根据请求过来的controller和action去查询可以被哪些角色操作: 这是查询数据库 roleid使用 1,2,3,4格式
RoleWithControllerAction roleWithControllerAction =
SampleData.roleWithControllerAndAction.FirstOrDefault(r => r.ControllerName.ToLower() == controllerName.ToLower() && r.ActionName.ToLower() == actionName.ToLower() && r.RoleIds.contails( "3" ));
// 有值处理
if (roleWithControllerAction != null )
{
//有权限操作当前控制器和Action的角色id
this .Roles = roleWithControllerAction.RoleIds;
}
else
{
//请求失败输出空结果
filterContext.Result = new EmptyResult();
//打出提示文字
HttpContext.Current.Response.Write( "对不起,你没有权限操作!" );
}
base .OnAuthorization(filterContext);
}
/// <summary>
/// 自定义授权检查(返回False则授权失败)
/// </summary>
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
//if (httpContext.User.Identity.IsAuthenticated)
//{
// string userName = httpContext.User.Identity.Name; //当前登录用户的用户名
// User user = SampleData.users.Find(u => u.UserName == userName); //当前登录用户对象
// if (user != null)
// {
// Role role = SampleData.roles.Find(r => r.Id == user.RoleId); //当前登录用户的角色
// foreach (string roleid in Roles.Split(','))
// {
// if (role.Id.ToString() == roleid)
// return true;
// }
// return false;
// }
// else
// return false;
//}
//else
// return false; //进入HandleUnauthorizedRequest
return true ;
}
/// <summary>
/// 处理授权失败的HTTP请求
/// </summary>
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
if ( string .IsNullOrWhiteSpace(AuthorizationFailView))
AuthorizationFailView = "error" ;
filterContext.Result = new ViewResult { ViewName = AuthorizationFailView };
}
}
|
二.单点登录方式使用application方式来实现
1.用户登录成功后记录当前信息
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
/// <summary>
/// 限制一个用户只能登陆一次
/// </summary>
/// <returns></returns>
private void GetOnline()
{
string UserID = "1" ;
Hashtable SingleOnline = (Hashtable)System.Web.HttpContext.Current.Application[Property.Online];
if (SingleOnline == null )
SingleOnline = new Hashtable();
IDictionaryEnumerator idE = SingleOnline.GetEnumerator();
string strKey = string .Empty;
while (idE.MoveNext())
{
if (idE.Value != null && idE.Value.ToString().Equals(UserID))
{
//already login
strKey = idE.Key.ToString();
//当前用户已存在移除、
SingleOnline.Remove(strKey);
System.Web.HttpContext.Current.Application.Lock();
System.Web.HttpContext.Current.Application[Property.Online] = SingleOnline;
System.Web.HttpContext.Current.Application.UnLock();
break ;
}
}
//SessionID
if (!SingleOnline.ContainsKey(Session.SessionID))
{
SingleOnline[Session.SessionID] = UserID;
System.Web.HttpContext.Current.Application.Lock();
System.Web.HttpContext.Current.Application[Property.Online] = SingleOnline;
System.Web.HttpContext.Current.Application.UnLock();
}
}
|
2.使用ActionFilter来实现单点登录,每次点击控制器都去查询过滤是否在其它地方登录
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
/// <summary>
/// 用户基础信息过滤器
/// </summary>
public class LoginActionFilter : ActionFilterAttribute
{
/// <summary>
/// 初始化地址
/// </summary>
public const string Url = "~/Login/Index?error=" ;
/// <summary>
/// 该方法会在action方法执行之前调用
/// </summary>
/// <param name="filterContext">上下文</param>
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
// 获取上一级url
// var url1 = filterContext.HttpContext.Request.UrlReferrer;
UserLoginBaseInfo _userLogin = filterContext.HttpContext.Session[Property.UerLoginSession] as UserLoginBaseInfo;
// 用户是否登陆
if (_userLogin == null )
{
filterContext.Result = new RedirectResult(Url + "登陆时间过期,请重新登陆!&url=" + filterContext.HttpContext.Request.RawUrl);
}
else
{
filterContext.HttpContext.Session.Timeout = 30;
}
//判断是否在其它地方登录
Hashtable singleOnline = (Hashtable)System.Web.HttpContext.Current.Application[Property.Online];
// 判断当前SessionID是否存在
if (singleOnline != null && !singleOnline.ContainsKey(HttpContext.Current.Session.SessionID))
filterContext.Result = new RedirectResult(Url + "你的帐号已在别处登陆,你被强迫下线!" );
base .OnActionExecuting(filterContext);
}
/// <summary>
/// 执行后
/// </summary>
/// <param name="filterContext"></param>
public override void OnResultExecuting(ResultExecutingContext filterContext)
{
//记录操作日志,写进操作日志中
var controllerName = filterContext.RouteData.Values[ "controller" ];
var actionName = filterContext.RouteData.Values[ "action" ];
base .OnResultExecuting(filterContext);
}
|
3.用户正常退出或则非正常退出处理当前用户信息销毁Session
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
/// <summary>
/// Session销毁
/// </summary>
protected void Session_End()
{
Hashtable SingleOnline = (Hashtable)Application[Property.Online];
if (SingleOnline != null && SingleOnline[Session.SessionID] != null )
{
SingleOnline.Remove(Session.SessionID);
Application.Lock();
Application[Property.Online] = SingleOnline;
Application.UnLock();
}
Session.Abandon();
}
|
以上所述是小编给大家介绍的Asp.net mvc 权限过滤和单点登录(禁止重复登录),希望对大家有所帮助,如果大家有任何疑问欢迎给我留言,小编会及时回复大家的!
原文链接:http://www.cnblogs.com/louby/archive/2016/12/08/6145810.html