ASP.NET MVC 基于页面的权限管理

本文介绍了一种使用ASP.NET MVC框架结合AOP思想(Filter)实现页面级别的权限管理方法,通过定义权限项、权限列表和UrlAuthorizeEntities类,实现了用户权限的获取与验证。具体包括权限项的定义、权限列表的获取、用户权限的获取、UrlAuthorizeAttribute过滤器的实现以及控制器中的应用,最后通过路由配置确保权限的有效性。案例展示了不同用户权限访问不同页面的场景。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

ASP.NET MVC 中运用AOP的思想(Filter)来实现页面级别的权限。在每个页面里,我们再去管理更小级别的权限。

1.Models

1)PermissionItem

namespace AspNetMvcAuthDemo1.Models
{
    public class PermissionItem
    {
        public int ID { set; get; }

        public int PermissionID { set; get; }

        public string Name { set; get; }

        public string Route { set; get; }
    }
}
2)PermissionList

namespace AspNetMvcAuthDemo1.Models
{
    public class PermissionList
    {
        public int ID { set; get; }

        public int PermissionID { set; get; }

        public int UserID { set; get; }
    }
}
3)UrlAuthorizeEntities

namespace AspNetMvcAuthDemo1.Models
{
    public class UrlAuthorizeEntities
    {
        public IEnumerable<PermissionItem> PermissionItems = new List<PermissionItem> 
        {
            new PermissionItem{ ID = 1 , PermissionID = 1, Name = "Test Page 1", Route = "/Home/Page1" },
            new PermissionItem{ ID = 2 , PermissionID = 2, Name = "Test Page 2", Route = "/Home/Page2" },
            new PermissionItem{ ID = 3 , PermissionID = 3, Name = "Test Page 3", Route = "/Home/Page3" },
            new PermissionItem{ ID = 4 , PermissionID = 1, Name = "Test Page 4", Route = "/Home/Page4" },
            new PermissionItem{ ID = 5 , PermissionID = 2, Name = "Test Page 5", Route = "/Home/Page5" }
        };

        public IEnumerable<PermissionList> PermissionList = new List<PermissionList>
        {
            new PermissionList{ ID = 1 , PermissionID = 2, UserID = 1},
            new PermissionList{ ID = 2 , PermissionID = 3, UserID = 1},
        };
    }
}
2.账户帮助类-AccountHelper

包含两个方法,获取所有权限列表并缓存,获取用户权限并缓存。

namespace AspNetMvcAuthDemo1.UrlAuthorize
{
    /// <summary>
    /// Account Helper
    /// </summary>
    public static class AccountHelper
    {
        /// <summary>
        /// Get all permission list
        /// </summary>
        /// <returns>Permission List</returns>
        public static List<PermissionItem> GetPermissionItems()
        {
            if (HttpContext.Current.Cache["PermissionItems"] == null)
            {
                UrlAuthorizeEntities db = new UrlAuthorizeEntities();
                var items = db.PermissionItems.Where(c => c.PermissionID > 0).ToList();
                HttpContext.Current.Cache["PermissionItems"] = items;
            }

            return (List<PermissionItem>)HttpContext.Current.Cache["PermissionItems"];
        }

        /// <summary>
        /// Get User Permission
        /// </summary>
        /// <param name="userID">User ID</param>
        /// <returns>User Permission Array</returns>
        public static Int32[] GetUserPermission(int userID)
        {
            if (HttpContext.Current.Session["Permission"] == null)
            {
                UrlAuthorizeEntities db = new UrlAuthorizeEntities();
                var permissions = db.PermissionList.Where(c => c.UserID == userID).Select(c=>c.PermissionID).ToArray();
                HttpContext.Current.Session["Permission"] = permissions;
            }
            return (Int32[])HttpContext.Current.Session["Permission"];
        }
    }
}
3.Filter(AOP)-UrlAuthorizeAttribute

继承自AuthorizeAttribute,重写其OnAuthorization方法,实现AOP。

namespace AspNetMvcAuthDemo1.UrlAuthorize
{
    /// <summary>
    /// URL permission
    /// </summary>
    public class UrlAuthorizeAttribute : AuthorizeAttribute
    {
        /// <summary>
        /// Rewrite OnAuthorization
        /// </summary>
        /// <param name="filterContext"></param>
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            //Get permission list
            List<PermissionItem> pItems = AccountHelper.GetPermissionItems();

            //Get current page permission ID,if items is null,the page you what to access has not been configed.
            var item = pItems.FirstOrDefault(c => c.Route == filterContext.HttpContext.Request.Path);

            if (item != null)
            {
                int[] permissions = AccountHelper.GetUserPermission(int.Parse(filterContext.HttpContext.Session["UserID"].ToString()));
                if (Array.IndexOf<Int32>(permissions, item.PermissionID) == -1)
                {
                    //have not permission
                    filterContext.HttpContext.Response.Write("You have no permission to access this page.");
                    filterContext.HttpContext.Response.End();
                }
            }
            else
            {
                //the page you what to access has not been configed.
                filterContext.HttpContext.Response.Write("The page you want to access has not been configed permission.");
                filterContext.HttpContext.Response.End();
            }
        }
    }
}
4.控制器

namespace AspNetMvcAuthDemo1.Controllers
{
    public class HomeController : Controller
    {
        public ActionResult Index()
        {
            return View();
        }

        public ActionResult About()
        {
            ViewBag.Message = "Your application description page.";

            return View();
        }

        public ActionResult Contact()
        {
            ViewBag.Message = "Your contact page.";

            return View();
        }

        public string Login()
        {
            HttpContext.Session["UserID"] = 1;
            return "Login success.";
        }

        [UrlAuthorize]
        public string Page1()
        {
            return "Page1";
        }

        [UrlAuthorize]
        public string Page2()
        {
            return "Page2";
        }

        [UrlAuthorize]
        public string Page3()
        {
            return "Page3";
        }

        [UrlAuthorize]
        public string Page4()
        {
            return "Page4";
        }

        [UrlAuthorize]
        public string Page5()
        {
            return "Page5";
        }

        [UrlAuthorize]
        public string Page6()
        {
            return "Page6";
        }
    }
}
6.Route Config

namespace AspNetMvcAuthDemo1
{
    public class RouteConfig
    {
        public static void RegisterRoutes(RouteCollection routes)
        {
            routes.IgnoreRoute("{resource}.axd/{*pathInfo}");

            routes.MapRoute(
                name: "Default",
                url: "{controller}/{action}/{id}",
                defaults: new { controller = "Home", action = "Login", id = UrlParameter.Optional }
            );
        }
    }
}
效果:

1)访问:http://localhost:5598/Home/Page1,结果:You have no permission to access this page.

2)访问:http://localhost:5598/Home/Page2,结果:Page2

3)访问:http://localhost:5598/Home/Page3,结果:Page3

4)访问:http://localhost:5598/Home/Page4,结果:You have no permission to access this page.

5)访问:http://localhost:5598/Home/Page5,结果:Page5

6)访问:http://localhost:5598/Home/Page6,结果:The page you want to access has not been configed permission.

具体逻辑请参照代码进行推理。(UserID =1 的用户有2,3权限,而2,3权限可以看2,3,5页面,所以,只有访问2,3,5才是合法的,其他都是非法,Page6没有配置,也是非法的,只是返回的错误信息不同。)

备注:这个做法是源于看过的博客园里面一个仁兄的做法写的,忘记文章链接了,在此表示感谢。










asp.net mvc 通用权限管理系统(响应布局)源码是基于asp.net(C#)MVC+前端bootstrap+ztree+lodash+jquery技术,采用bootstrap为前台开发展示UI,Web Api主要负责前端的逻辑交互,再结合jQuery Ajax+Web Api进行提交数据请求。 框架特色: 1、为了数据方便读写,语言的成熟性,选择asp.net开发效率更高效率更快; 2、系统架构采用:耦合性低、重用性高、部署快、可维护性高等优点的MVC框架进行搭建; 3、系统配置文件数据采用HttpRuntime.Cache进行缓存,使得程序在运行中效率更高、速度更快; 4、数据库的选型,根据系统的数据规模与需求方的相关要求,综合多方考量,调研多种数据库后选定mysql为系统数据库; 5、运行环境根据功能模块的特点,选型window server2008+IIS,部署更简洁; 6、使用报表导出开源组件NPOI可以在没有安装Office的情况下对Word或Excel文档进行读写操作; 7、为了兼容更多的浏览器,让用户界面使用更友好。我们选择了响应式布局框架bootstrap; 8、系统报表我们采用了echarts开源软件,并且我们提供了非常炫酷的图形界面,特色是地图,另外还提供了柱状图、折线图、饼图、气泡图及四象限图等; 9、系统采用bootstrap响应式布局,这样面对不同分辨率设备灵活性强能够快捷解决多设备显示适应问题; 10、系统基于ASP.NET(C#) MVC +web api+Bootstrap +Jquery+ MYSQL前端采用响应式布局对页面兼容性显著提高; 系统优势: 代码可以满足大部分开发者的需求,让开发人员能省不少时间 ASP.NET MVC通用角色权限管理系统源码 更新日志: 2020-03-23 更新如下: 1、新增文件上传功能实例,保证文件能够无误上传保存并下载; 2、优化后台系统框架代码,删除以前大项目其它无用功能; 3、新增页面代码JS、css文件的压缩,使得系统运行速度更快; 4、系统登录页面新增验证校验过程,这样做到输入验证码时时验证; 5、优化系统加载页面提示数据加载功能。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值