[C#] Authorize permission class under .Net Framework framework

2023, Week 31, Article 3. Give yourself a goal, and then insist that there will always be a receipt, if you don’t believe me, try it!
In C#'s .NET Framework, you can use Authorizeclasses to handle authentication. AuthorizeClasses live System.Web.Mvcin namespaces, which provide an easy way to restrict access to action methods in controllers.

1. Authorize permission class

To use authorization authentication in the controller, you can follow the steps below:

1. Import namespace

First, make sure your project references System.Web.Mvcthe namespace. You can add the following references to the statement in your project file using:

using System.Web.Mvc;

2. Permission Code

Use attributes on operation methods that require authorization authentication Authorize. This attribute can set multiple parameters to specify different authentication rules.

[Authorize]  // 只有经过认证的用户才能访问该方法
public ActionResult MyAction()
{
    
    
   // 在这里编写方法的具体逻辑
}

You can also Authorizepass parameters in the attribute to specify other authentication rules. For example, to require a user to belong to a specific role to access a method:

[Authorize(Roles = "Admin")]  // 需要属于 "Admin" 角色的用户才能访问该方法
public ActionResult MyAction()
{
    
    
   // 在这里编写方法的具体逻辑
}

Alternatively, require that the user must belong to multiple roles at the same time to access the method:

[Authorize(Roles = "Admin,Manager")]  // 需要同时属于 "Admin" 和 "Manager" 角色的用户才能访问该方法
public ActionResult MyAction()
{
    
    
   // 在这里编写方法的具体逻辑
}

You can also set other authentication rules, such as requiring users to authenticate through a specific authentication provider:

[Authorize(AuthenticationSchemes = "MyAuthScheme")]  // 需要使用名为 "MyAuthScheme" 的认证提供程序进行认证
public ActionResult MyAction()
{
    
    
   // 在这里编写方法的具体逻辑
}

The above are Authorizethe basic steps for using classes for authorization authentication. You can set different authentication rules according to your specific needs to achieve flexible permission control.

2. How to authorize

In the .NET Framework of C#, Authorizeclasses can help you authenticate permissions, and authorization tasks are usually handled by authentication (Authentication) providers.
Authentication providers are responsible for authenticating users, while authorization providers are responsible for assigning appropriate permissions to authenticated users.

To implement authorization, you can follow these steps:

1. Set up authentication

First, make sure you've set up authentication. You can use the authentication mechanisms provided in the .NET Framework (such as Forms Authentication, Windows Authentication, etc.), or use a third-party authentication solution.

2. Assign permissions

Use an authorization provider, such as a role provider, to assign permissions to users. Authorization providers determine what users are able to do based on who they are.

You can specify the authorization provider to use in a configuration file (such as web.config). For example, if you use a role provider, you can add the following configuration to the configuration file:

<system.web>
 <authorization>
   <allow roles="Admin" />
   <deny users="*" />
 </authorization>
</system.web>

1) The above configuration indicates that only users belonging to the "Admin" role are authorized to access, while other users are denied access.

2) In addition to configuration files, you can also use authorization providers in your code for authorization.
3) For example, a method can be used in the controller's action method User.IsInRoleto check if the user belongs to the specified role:

[Authorize(Roles = "Admin")]
public ActionResult MyAction()
{
    
    
   if (User.IsInRole("Admin"))
   {
    
    
       // 用户是管理员，执行操作逻辑
   }
   else
   {
    
    
       // 用户不是管理员，执行其他逻辑
   }
}

1) If the user does not have the required permissions, Unauthorizedthe method can be called to return an unauthorized error page or perform other operations.
2) In this way, when a user tries to access Authorizean operation method protected by attributes, the system will judge whether the user has access rights according to the authorization rules.
3) If the user is successfully authenticated and has the required permissions, the operation can proceed; otherwise, the user will be denied access.
4) It should be noted that authorization is only a part of the application, you also need to ensure that authentication and other related settings are properly configured to fully protect your application.

3. Permission advantages and disadvantages

There are some advantages and disadvantages to consider when using classes in the .NET Framework in C# Authorizefor permission control.

1. Advantages

1) Ease of use: AuthorizeClasses provide an easy way to restrict access to action methods in controllers. By using Authorizeattributes, you can easily introduce permission control logic into your code.
2) Flexibility: AuthorizeThe class provides a variety of configuration options, and flexible permission settings can be made according to specific needs. You can specify authentication rules, role requirements, authorization providers, etc. to suit different scenarios and permission requirements.
3) Integration: AuthorizeThe class is seamlessly integrated with the authentication mechanisms in the .NET Framework (such as Forms authentication, Windows authentication). By using an authorization provider, you can easily combine authentication and authorization functionality.

2. Disadvantages

1) Rely on .NET Framework: AuthorizeClasses are a unique feature of .NET Framework. If your application is considering migrating to other platforms, you may need to consider different permission control solutions.
2) Limitations: AuthorizeClasses can only be used in the operation method in the controller. If you need more fine-grained permission control, such as permission control on a single page element, you may need to use other methods to achieve it.
3) Learning curve: If you are a novice, learning and understanding the concept and implementation of authorization may take a certain amount of time and learning costs.

To sum up, Authorizeclasses provide a simple and flexible way to control permissions, which is suitable for permission requirements in most cases.
However, when choosing a permission control scheme, you need to comprehensively consider factors such as your application's specific needs, platform dependencies, and learning costs to make the most suitable choice.