Use mvchandler to design custom system Permissions

This article is the next article that explains how to use mvchandler to design custom system permissions. Through this article, I will propose a solution for system permissions in mvc2.0. If there are any deficiencies, I hope you can point it out. Thank you!

 

I. Review the content in the previous article:

Review the myhandler class in the previous Article 3.2, which inherits the mvchandler class of mvc2.0. The Code is as follows:

Protected override system. iasyncresult beginprocessrequest (system. web. httpcontext, system. asynccallback callback, object state) {if (1 = 1) // system permission entry {// when conditions are met, you can jump to a custom httphandler, such as (error. aspx. Httpcontext. response. Redirect ("http://www.cnblogs.com/ryanding"); return NULL;} return base. beginprocessrequest (httpcontext, callback, State );}

The above code is pasted. We want to explain that our permission judgment should be injected into line 1, which is in this if statement. The permission is injected into row 3. I personally think this permission is built out of the entire MVC framework. The efficiency should be higher, and the Asp.net MVC version will be upgraded in the future. To some extent, this permission structure is not restricted by the MVC Framework. Is it better to inherit the authorizeattribute feature to control permissions? Otherwise, the "Anti-reflection School" will start to talk about things with efficiency.

 

Ii. Open the topic and inject the permission function into the system

First read the following code:

Protected override system. iasyncresult beginprocessrequest (system. web. httpcontext, system. asynccallback callback, object state) {// use the system. security. principal saves the username after logon // sample code. Here, the username assignment is not rigorous. Please note that the object is null and the string username = httpcontext. user. identity. name; If (string. compare (username, "admin", true) = 0) {// when conditions are met, you can jump to a custom httphandler, such as (error. aspx. Httpcontext. response. Redirect ("http://www.cnblogs.com/ryanding"); return NULL;} return base. beginprocessrequest (httpcontext, callback, State );}

Here we still use the. NET classic system. Security. Principal class library.Get the username string for logon from httpcontext. User. Identity (get the value from the name attribute ). In the login view, the user information for successful logon is saved. On the login view logon page, you do not need to process permissions. You can open everyone. The background code is as follows:

FormsAuthenticationService auth = new FormsAuthenticationService();auth.SignIn("admin", false);

If admin is the current user, the admin is hard-coded and should be obtained from the UI.

 

Iii. Specific implementation ideas

In mvc2.0, if an action is used for determination, the area mechanism will inevitably be taken into account. Because the same controller and action may appear in different areas. Therefore, you also need to add the area to the logic for determining the permission. In this way, all MVC URLs can be precisely controlled. For example, you can use areaname + controllername + actionname to identify the specific URL of the system and process permissions conveniently. We willThe beginprocessrequest method is transformed as follows:

Protected override system. iasyncresult beginprocessrequest (system. web. httpcontext, system. asynccallback callback, object state) {// use the system. security. principal saves the username after logon // sample code. Here, the username assignment is not rigorous. Please note that the object is null and the string username = httpcontext. user. identity. name; // "admin" string strareaname = base. requestcontext. routedata. datatokens ["area"] = NULL? "": Base. requestcontext. routedata. datatokens ["area"]. tostring (); // "testmvc. areas. admin. controllers "string strnamespaces = base. requestcontext. routedata. datatokens ["namespaces"] = NULL? "": Base. requestcontext. routedata. datatokens ["namespaces"]. tostring (); // "Index" string straction = base. requestcontext. routedata. values ["action"]. tostring (); // "home1" string strcontroller = base. requestcontext. routedata. values ["controller"]. tostring (); // todo: Add area + Action + controller to the permission judgment. If (string. compare (username, "admin", true) = 0) {// when conditions are met, you can jump to a custom httphandler, such as (error. aspx. Httpcontext. response. Redirect ("http://www.cnblogs.com/ryanding"); return NULL;} return base. beginprocessrequest (httpcontext, callback, State );}

Obtain the area information from the MVC okens of MVC routedata. Values obtains the action and controller information, and then participates in the specific permission judgment.

  


Iv. Notes

Throughout the debugging process, I found that there was only one place for me to debug for a long time:Myhandler cannot control the internal actions of an area. Later, I checked the relevant information and used to set the problem in arearegistration (class automatically generated after area is added in mvc2.0. Paste the code for reference:

    public override void RegisterArea(AreaRegistrationContext context)        {            context.Routes.Add(new Route("{area}/{controller}/{action}/{id}"                               , new RouteValueDictionary(new { area = "admin", controller = "Home1", action = "Index", id = "" })                               , new RouteValueDictionary(new { area = "admin" })                               , new RouteValueDictionary(new {area = "admin",  Namespaces = "TestMvc.Areas.admin.Controllers" })                               , new HelloWorldHandler()));        }

The structure of the newly added area is as follows:

 

Now, you can add the permission mechanism in mvc2.0. I believe that injecting a custom permission structure into the MVC program in this way is always better than using httpmodule, because this type of URL does not need to be filtered when the client requests CSS/Js. The code looks more comfortable and the judgment is simpler.

 

I hope this article will help you. If you have any shortcomings, thank you!