介绍
怎么在asp.net中利用AccessControlHelper控制访问权限?相信很多没有经验的人对此束手无策,为此本文总结了问题出现的原因和解决方法,通过这篇文章希望你能解决这个问题。
<强>安装AccessControlHelper nuget包#
安装nuget包WeihanLi.AspNetMvc。AccessControlHelper
dotnet add package WeihanLi.AspNetMvc。AccessControlHelper <>强实现自己的访问策略#
<强>资源访问策略/API访问策略#
以下代码定义了一个简单的访问策略,需要登录且拥有管理角色,可以根据自己需要调整优化
public class AdminPermissionRequireStrategy : IResourceAccessStrategy
{
private 才能readonly IHttpContextAccessor _accessor;
public 才能;AdminPermissionRequireStrategy (IHttpContextAccessor 访问器)
{才能
,,,_accessor =,访问器;
,,}
public 才能;bool IsCanAccess (string accessKey)
{才能
,,,var user =, _accessor.HttpContext.User;
,,,return user.Identity.IsAuthenticated ,,, user.IsInRole (“Admin");
,,}
public 才能IActionResult DisallowedCommonResult =祝辞new ContentResult
{才能
,,,Content =,“No Permission"
,,,ContentType =,“文本/plain"
,,,StatusCode =403
,,};
public 才能IActionResult DisallowedAjaxResult =祝辞,new JsonResult (new JsonResultModel
{才能
,,,ErrorMsg =,“No Permission"
,,,Status =JsonResultStatus.NoPermission
,,});
} <强>页面元素访问策略#
定义页面元素/控件访问策略:
public class AdminOnlyControlAccessStrategy : IControlAccessStrategy
{
private 才能readonly IHttpContextAccessor _accessor;
public 才能;AdminOnlyControlAccessStrategy (IHttpContextAccessor httpContextAccessor),=祝辞,_accessor =, httpContextAccessor;
public 才能;bool IsControlCanAccess (string accessKey)
{才能
,,,if (“Never" .Equals (accessKey, System.StringComparison.OrdinalIgnoreCase))
,,,{
,,,,,return 假;
,,,}
,,,var user =, _accessor.HttpContext.User;
,,,return user.Identity.IsAuthenticated ,,, user.IsInRole (“Admin");
,,}
} <>强服务注册配置#
在初创公司里注册服务:
services.AddAccessControlHelper ()
.AddResourceAccessStrategy<才能;Filters.AdminPermissionRequireStrategy> ()
.AddControlAccessStrategy<才能;Filters.AdminOnlyControlAccessStrategy> ()
,,, 如果你只是web api,不涉及到页面元素的权限控制可以只注册ResourceAccessStrategy
services.AddAccessControlHelper ()
.AddResourceAccessStrategy (); 默认访问策略的生命周期是单例的,如果需要注册为范围,可以指定默认的生命周期
services.AddAccessControlHelper ()
.AddResourceAccessStrategy (ServiceLifetime.Scoped); <强> API/资源的权限控制#
对于asp.net核心应用推荐使用政策来控制权限的访问,可以在需要权限控制的行动或者控制器上设置(授权(“AccessControl"))或者(授权(AccessControlHelperConstants.PolicyName))
(授权(AccessControlHelperConstants.PolicyName))
public class SystemSettingsController : AdminBaseController
{//,才能……
} (授权(AccessControlHelperConstants.PolicyName))
public ActionResult UserList ()
{
return 才能视图();
} <强>页面元素的权限控制#
<强>引用TagHelper #
在视图目录下的_ViewImports。cshtml文件中导入AccessControlHelper的TagHelper
@using ActivityReservation
@using WeihanLi.AspNetMvc.AccessControlHelper
@using WeihanLi.AspNetMvc.MvcSimplePager
@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
@addTagHelper *, WeihanLi.AspNetMvc。AccessControlHelper 详见:https://github.com/WeihanLi/ActivityReservation/blob/dev/ActivityReservation/Areas/Admin/Views/_ViewImports.cshtml
<强>页面元素配置#
