MVC HTTP 错误 403.14 - 创建新记录后被禁止

Question

1- AuthorizeUserAttribute.cs 是服装授权属性的类

public class AuthorizeUserAttribute : AuthorizeAttribute

{

public string AccessLevel { get; set; }
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    var isAuthorized = base.AuthorizeCore(httpContext);
    if (!isAuthorized)
        return false;

    if (this.AccessLevel.Contains("Admin"))
    {
        return true;
    }
    else return false;
}

2- 这是我的控制器

[AuthorizeUser(AccessLevel = "Admin")]

public class ProductsController : Controller

 {
private DataBaseContext db = new DataBaseContext();
public ActionResult Index()
{
    var product = db.Product.Include(p => p.ProductGroup);
    return View(product.ToList());
}

}



[AuthorizeUser(AccessLevel = "Admin")]

public ActionResult Create([Bind(Include = "Product_Id,ProductName,Description,PicUrl,Group_Id")] Product product)
{
    if (ModelState.IsValid)
    {
        db.Product.Add(product);
        db.SaveChanges();
        return RedirectToAction("Index");
    }

    ViewBag.Group_Id = new SelectList(db.ProductGroups, "Group_Id", "GreoupName", product.Group_Id);
    return View(product);
}

start_up 文件夹中的 3-FilterConfig.cs

public class FilterConfig

{
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new HandleErrorAttribute());
    filters.Add(new AuthorizeAttribute());
    filters.Add(new AuthorizeUserAttribute());

}
}

4-Global.asax.cs

void Application_Start(object sender, EventArgs e)
{
    // Code that runs on application startup
    AreaRegistration.RegisterAllAreas();
    GlobalConfiguration.Configure(WebApiConfig.Register);
    RouteConfig.RegisterRoutes(RouteTable.Routes);     
    FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
    AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

}

5- Admin1Controller.cs 用于登录等...

[HttpPost]
public ActionResult Login(LoginViewModel model)
{
    if (!ModelState.IsValid) //Checks if input fields have the correct format
    {
        return View(model); //Returns the view with the input values so that the user doesn't have to retype again
    }

            if(model.Email == "info@psmgroups.com" & model.Password == "@1234psm")
                { 
            var identity = new ClaimsIdentity(new[] {
                                          new Claim(ClaimTypes.Name,"Admin" ),
                                          new Claim(ClaimTypes.Email, "info@psmgroups.com"),
                                          new Claim(ClaimTypes.Role,"Admin")

                                            }, "ApplicationCookie");

            var ctx = Request.GetOwinContext();
            var authManager = ctx.Authentication;
            authManager.SignIn(identity);

                    return Redirect(GetRedirectUrl(model.ReturnUrl));
                }
    ModelState.AddModelError("", "incorrect UserName or pass");
    return View(model);


}

创建新产品并返回产品后/显示 HTTP 错误 403.14 - 禁止页面。编写产品/索引时显示正确的页面

Answer 1

首先，这里没有任何代码实际上会在您的自定义属性上设置AccessLevel 属性。也许您只是没有发布它，但如果这是您的全部代码，那么这不起作用的原因很明显：AccessLevel 始终为空，因此从不包含字符串“Admin”。

也就是说，这里甚至不需要自定义属性。 AuthorizeAttribute 已经处理角色。您似乎正在尝试实现某种类似角色的并行功能，但这是在浪费时间。做吧：

[Authorize(Roles = "Admin")]

收工。