ASP.NET页面授权……你是怎么做到的？

我首先实现了一个名为SecuredPage的类,如下所示：

public class SecuredPage : System.Web.UI.Page
{
    // Those Permissions are mandatory,so user needs to have all of them
    public List MandatoryPermissions { get; set; }

    // Those Permissions are optional,so if the user have at least one of them,he can access
    public List OptionalPermissions { get; set; }

    protected override void OnLoad(EventArgs e)
    {
        MyUser loggedUser = (MyUser) this.User;

        base.OnLoad(e);

        foreach (Permission mandatoryPermission in MandatoryPermissions)
        {
            // if the user don't have permission,we can redirect him
            if (!loggedUser.HasPermission(mandatoryPermission))
            {
                RedirectToDontHaveAccess();
                break;
            }
        }

        bool hasAccessToThePage = false;

        foreach (Permission optionalPermission in OptionalPermissions)
        {
            // If the user has at least one of the permissions,he can access
            if (loggedUser.HasPermission(optionalPermission))
            {
                hasAccessToThePage = true;
            }
        }

        if (!hasAccessToThePage)
        {
            RedirectToDontHaveAccess();
        }

    }

    private void RedirectToDontHaveAccess()
    {
        throw new NotImplementedException();
    }
}

对于用户需要访问权限的所有页面,这将是我的BasePage.
MandatoryPermissions是用户必须拥有访问页面的权限,而OptionalPermissions是用户至少需要其中一个访问页面的权限.
没有必要在每个页面上同时使用这两个页面,因为如果您有MandatoryPermissions,则无论您是否拥有选项都无关紧要.

许可是一个枚举：

public enum Permission
{
    // Usually this enum will replicate a domain table from the database
    EditUser = 1,SearchUserByUsername = 2,SearchUserByEmail = 3

}

而MyUser是MembershipUser的一个实现：

public class MyUser : System.Web.Security.MembershipUser
{
    internal bool HasPermission(Permission permission)
    {
        //
        // TODO: Check on database if the user has the permission or not
        //
    }
}

然后,您在页面中唯一需要做的就是填充权限列表：

public partial class EditUser : SecuredPage
{
    protected void Page_Load(object sender,EventArgs e)
    {
        MandatoryPermissions.Add(Permission.EditUser);
    }
}

public partial class SearchUser : SecuredPage
{
    protected void Page_Load(object sender,EventArgs e)
    {
        OptionalPermissions.Add(Permission.SearchUserByUsername);
        OptionalPermissions.Add(Permission.SearchUserByEmail);
    }
}

好的,搜索示例不是那么好,但我认为你得到了图片.

整个想法是base.OnLoad(e);在权限验证之前调用,因此您只需要填写Page_Load中的权限.

我不确定这是否是最佳解决方案,但我确信它有很大帮助:)