如何在MVC.net核心中授权会话

Question

我只想在用户登录时授权创建操作？我该如何做到这一点？

应用程序DBContext.cs

namespace BookReadingEvents.Data
{
public class ApplicationDbContext : DbContext
{
public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options) : base(options)
{
}
public DbSet<BookReadingEvent> BookReadingEvents { get; set; }
public DbSet<Register> RegisterAccount { get; set; }
public DbSet<Login> LoginAccount { get; set; }
}
}

RegisterController.cs

namespace BookReadingEvents.Controllers
{
public class RegisterController : Controller
{
private readonly ApplicationDbContext _db;
[ActivatorUtilitiesConstructor]
public RegisterController(ApplicationDbContext db)
{
_db = db;
}
public IActionResult Index()
{
return RedirectToAction("Register");
}
// GET Register
public IActionResult Register()
{
return View();
}
//POST Register
[HttpPost]
public IActionResult Register(Register user)
{

if (ModelState.IsValid)
{
_db.RegisterAccount.Add(user);
_db.SaveChanges();
return RedirectToAction("Index");
}


return View(user);
}
}
}

LoginController.cs

public class LoginController : Controller
{

private readonly ApplicationDbContext _db;
[ActivatorUtilitiesConstructor]
public LoginController(ApplicationDbContext db)
{
_db = db;
}
public IActionResult Index()
{
return RedirectToAction("Login");
}
// GET Login
public IActionResult Login()
{
return View();
}
//POST Login
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult Login(Login user)
{
if (ModelState.IsValid)
{
var obj = _db.RegisterAccount.Where(u => u.Email.Equals(user.Email) && u.Password.Equals(user.Password)).FirstOrDefault();
if (obj != null)
{
user.RegisterId = obj.RegisterId;
_db.LoginAccount.Add(user);
_db.SaveChanges();
HttpContext.Session.SetObjectAsJson("Register", obj);
return RedirectToAction("LoggedIn");
}
}
ModelState.AddModelError("", "Some Error Occured");
return RedirectToAction("Login");
}
public IActionResult LoggedIn()
{
var userDetails = HttpContext.Session.GetObjectFromJson<Register>("Register");
int? thisUserID = Convert.ToInt32(userDetails.RegisterId);
if (thisUserID != null)
{
return RedirectToAction("Index","Home");
}
else
{
return RedirectToAction("Login");
}
}
public IActionResult Logout()
{
HttpContext.Session.Clear();
//HttpContext.Session.Abandon();
return RedirectToAction("Index", "Home");
}
public IActionResult MyEvents()
{
return View();
}

}
}

会话扩展.cs

public static class SessionExtension
{
public static void SetObjectAsJson(this ISession session, string key, object value)
{
session.SetString(key, JsonConvert.SerializeObject(value));
}
public static T GetObjectFromJson<T>(this ISession session, string key)
{
var value = session.GetString(key);
return value == null ? default(T) : JsonConvert.DeserializeObject<T>(value);
}
}

BookReadingEventController.cs

namespace BookReadingEvents.Controllers
{
public class BookReadingEventController : Controller
{
private readonly ApplicationDbContext _db;
public BookReadingEventController(ApplicationDbContext db)
{
_db = db;
}
public IActionResult Index()
{
IEnumerable<BookReadingEvent> objList = _db.BookReadingEvents;
return View(objList);
}
// GET Create
//[Authorize]
//InvalidOperationException: No authenticationScheme was specified, 
//and there was no DefaultChallengeScheme found. 
public IActionResult Create() 
{
ViewBag.StartTimeDD = new List<string> {  "00:00", "01:00", "02:00", "03:00" , "04:00", "05:00", "06:00", "07:00", "08:00" , "09:00" ,"10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00","17:00", "18:00", "19:00",
"20:00", "21:00", "22:00", "23:00"};
return View();
}
// POST Create
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult Create(BookReadingEvent obj)
{
ViewBag.StartTimeDD = new List<string> {  "00:00", "01:00", "02:00", "03:00" , "04:00", "05:00", "06:00", "07:00", "08:00" , "09:00" ,"10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00","17:00", "18:00", "19:00",
"20:00", "21:00", "22:00", "23:00"};
if (ModelState.IsValid)
{
_db.BookReadingEvents.Add(obj);
_db.SaveChanges();
return RedirectToAction("Index");
}
return View(obj);
}
public IActionResult Display(int id)
{
var obj = _db.BookReadingEvents.Find(id);
if (obj == null)
{
return NotFound();
}
return View(obj);
}
// GET Update
//[Authorize]
//InvalidOperationException: No authenticationScheme was specified, 
//and there was no DefaultChallengeScheme found.
public IActionResult Update(int? id)
{
ViewBag.StartTimeDD = new List<string> {  "00:00", "01:00", "02:00", "03:00" , "04:00", "05:00", "06:00", "07:00", "08:00" , "09:00" ,"10:00", "11:00", "12:00", "13:00", "14:00", "15:00", "16:00","17:00", "18:00", "19:00",
"20:00", "21:00", "22:00", "23:00"};
if (id == null || id == 0)
{
return NotFound();
}
var obj = _db.BookReadingEvents.Find(id);
if (obj == null)
{
return NotFound();
}
return View(obj);
}
// POST Update
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult Update(BookReadingEvent obj)
{
if (ModelState.IsValid)
{
_db.BookReadingEvents.Update(obj);
_db.SaveChanges();
return RedirectToAction("Index");
}
return View(obj);
}
}
}

我想授权创建和更新操作，这样只有当用户登录后，他们才能创建或更新表。我该如何做到这一点？

Answer 1

我注意到，当用户成功登录时，您在登录方法中设置了一个会话，其中key是Register，如果您想授权会话。你可以使用IActionFilter来实现它。我在这里写了一个简单的演示。

过滤器

public class SessionFilter : Attribute,IActionFilter
{

public void OnActionExecuting(ActionExecutingContext context)
{
//if there is no session whitch key is "register", user will not access to specified action and redirect to login page.
var result = context.HttpContext.Session.GetObjectFromJson<T>("register");
if (result==null)
{
context.Result = new RedirectToActionResult("Login", "Login", null);
}
}
public void OnActionExecuted(ActionExecutedContext context)
{

}
}

然后，您可以将[SessionFilter]添加到要保护的操作中。

[HttpPost]
[SessionFilter]
[ValidateAntiForgeryToken]
public IActionResult Create(BookReadingEvent obj)
{.......}