How do I create a custom attribute to extend existing Authorize attribute in MVC?
-
Please add more details, what exactly you want to extend?Mike Chaliy– Mike Chaliy2009-02-16 18:30:27 +00:00Commented Feb 16, 2009 at 18:30
-
for now i just want to be able to redirect to the correct page rather than the default home page.zsharp– zsharp2009-02-16 18:33:24 +00:00Commented Feb 16, 2009 at 18:33
-
5You can update your question, so everybody will be able to know what you need.Mike Chaliy– Mike Chaliy2009-02-16 19:25:24 +00:00Commented Feb 16, 2009 at 19:25
Add a comment
|
4 Answers
Derive your class from AuthorizeAttribute. Override the OnAuthorization method. Add and set up a CacheValidationHandler.
public void CacheValidationHandler( HttpContext context,
object data,
ref HttpValidationStatus validationStatus )
{
validationStatus = OnCacheAuthorization( new HttpContextWrapper( context ) );
}
public override void OnAuthorization( AuthorizationContext filterContext )
{
if (filterContext == null)
{
throw new ArgumentNullException( "filterContext" );
}
if (AuthorizeCore( filterContext.HttpContext ))
{
... your custom code ...
SetCachePolicy( filterContext );
}
else if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
{
// auth failed, redirect to login page
filterContext.Result = new HttpUnauthorizedResult();
}
else
{
... handle a different case than not authenticated
}
}
protected void SetCachePolicy( AuthorizationContext filterContext )
{
// ** IMPORTANT **
// Since we're performing authorization at the action level, the authorization code runs
// after the output caching module. In the worst case this could allow an authorized user
// to cause the page to be cached, then an unauthorized user would later be served the
// cached page. We work around this by telling proxies not to cache the sensitive page,
// then we hook our custom authorization code into the caching mechanism so that we have
// the final say on whether a page should be served from the cache.
HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
cachePolicy.SetProxyMaxAge( new TimeSpan( 0 ) );
cachePolicy.AddValidationCallback( CacheValidationHandler, null /* data */);
}
2 Comments
Nick Masao
How can I make this work with Roles? It works ok now but seems like roles are not working. Also AuthorizeCore keeps returning false even when the user is Authenticated which means SetCachePolicy() never gets executed.
tvanfosson
@Nick - I've since blogged about improving the cache handling aspects: farm-fresh-code.blogspot.com/2011/03/…
You do not need to extend this attribute, web.config is enough. Please read about forms Element for authentication. Pay your attention on defaultUrl. This is something what you need.
<system.web>
<authentication mode="Forms">
<forms defaultUrl="YourUrlGoesHere"/>
</authentication>
</system.web>
4 Comments
zsharp
but thats not dynamic. url changes.
Mike Chaliy
Hm, why not to specify all requirments before one will give solution?
handles
Noo! This is completely wrong: blogs.msdn.com/b/rickandy/archive/2010/08/24/…
MrBoJangles
Uh-oh. If the assertion that is made in that blog entry's opening graph is correct, you should probably cut your losses and delete the answer.
public class CoolAuthorizeAttribute : AuthorizeAttribute
{
}
Comments
I suggest if you just want to extend the current AuthorizeAttribute and add your own authorization on top of that, instead of overriding OnAuthorization just override AuthorizeCore and add your MyCustomAuthorizationHolds condition to it.
public class CustomAuthorizeAttribute : AuthorizeAttribute
{
// This method must be thread-safe since it is called by the thread-safe OnCacheAuthorization() method.
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (base.AuthorizeCore(httpContext) && MyCustomAuthorizationHolds)
return true;
return false;
}
}
