ASP.NET MVC5中使用IAuthenticationFilter來驗證登錄和權限的陷井，你知道嗎？

今天發現使用，FilterAttribute, IActionFilter來做權限攔截也有這個問題。使用不當，照樣會調用Action里面方法，你可以打個斷點檢查一下你的代碼。

下面是我寫的偽代碼可以參考：

public class AuthorizeSessionAttribute : FilterAttribute, IActionFilter
{
	public void OnActionExecuting(ActionExecutingContext filterContext)
	{
		var user = LoginStateHelper.CurrentUser;
		var isAjax = filterContext.HttpContext.Request.Headers["X-Requested-With"] == "XMLHttpRequest";
        var accept = filterContext.HttpContext.Request.Headers["Accept"] ?? "";
		if (user == null)
		{
			if (isAjax || accept.IndexOf("application/json") > -1)
			{
				var result = new CommonResult();
				result.Message = "登錄過期請，請重新登錄！";
				result.State = 0;
				result.Data = "/Account/Logon";
				filterContext.Result = new JsonResult() { Data = result, ContentType = "application/json; charset=utf-8" };
				//filterContext.HttpContext.Response.Write(str);
				//filterContext.HttpContext.Response.End();
			}
			else
				filterContext.Result = new RedirectResult("/Account/Logon");
		}
		else
		{
			if (權限檢查，若無權限)
			{
				if (isAjax || accept.IndexOf("application/json") > -1)
				{
					var result = new CommonResult();
					result.Message = "無權限";
					filterContext.Result = new JsonResult() { Data = result, ContentType = "application/json; charset=utf-8" };
				}
				else
				{
					filterContext.Result = new ContentResult() { Content = "無權限"; };
				}
			}
			
		}
	}
	
	public void OnActionExecuted(ActionExecutedContext filterContext)
	{
		
	}
}

注意：

若驗證不通過一定要為filterContext.Result賦值。可以是常用以下類型作為返回：

跳轉：RedirectResult

json數據：JsonResult

純文本：ContentResult