我怎么能很容易地检查用户提交的查询是否属于他们或不是在.net核心?

Question

授权集

services.AddAuthorization(options =>
{
options.AddPolicy("MustNutritionist", policy =>
policy.RequireClaim("nutritionistId"));
});

控制器

NutritionistUpdateModel有id字段。

[Authorize(Policy = "MustNutritionist")]
public BaseResponseModel PostEdit([FromForm] NutritionistUpdateModel nutritionistUpdateModel)
{
try
{
var result = nutritionistService.EditNutritionist(nutritionistUpdateModel);
if (result)
{
return new SuccessResponseModel<bool>(result);
}
else
{
return new BaseResponseModel(ReadOnlyValues.NutritionistNotFound);
}
}
catch (Exception ex)
{
return new BaseResponseModel(ex.Message);
}
}

令牌生成声明

claims.Add(new Claim("nutritionistId", nutritionistId.ToString()));

我想检查NutritionistUpdateModel方程。我和索赔。我可以检查下面的代码。但是我必须写很多if else语句。有什么简单的方法吗?

private bool ChechNutritionistAuthorize(int nutritionistId)
{
var currentUser = HttpContext.User;
var nutritionistIdClaim=Int32.Parse(currentUser.Claims.FirstOrDefault(c => c.Type == "NutritionistId").Value);
if (nutritionistIdClaim == nutritionistId)
{
return true;
}
else
{
return false;
}
}

Answer 1

使用这样的扩展方法

public static class IdentityExtensions
{
public static bool ValidateNutritionistId(this ClaimsPrincipal principal, int nutritionistId)
{
if (principal == null)
throw new ArgumentNullException(nameof(principal));
int.TryParse(principal.Claims.FirstOrDefault(c => c.Type == "NutritionistId").Value, out int nutritionistIdClaim);
return nutritionistIdClaim == nutritionistId;
}

}

你可以这样写

HttpContext.User.ValidateNutritionistId(your id here )

，你还需要添加using语句，并在所有控制器中重用相同的方法