我正在使用jquery對asp.net mvc控制器動作進(jìn)行ajax調(diào)用：[AcceptVerbs(HttpVerbs.Post)] public ActionResult GetWeek(string startDay) { var daysOfWeek = CompanyUtility.GetWeek(User.Company.Id, startDay); return Json(daysOfWeek); }會話超時時，此調(diào)用將失敗，因為User對象存儲在會話中。我創(chuàng)建了一個自定義授權(quán)屬性，以檢查會話是否丟失并重定向到登錄頁面。這適用于頁面請求，但不適用于ajax請求，因為您無法從ajax請求進(jìn)行重定向：[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)] public class AuthorizeUserAttribute : AuthorizeAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { if (!httpContext.Request.IsAjaxRequest()) {//validate http request. if (!httpContext.Request.IsAuthenticated || httpContext.Session["User"] == null) { FormsAuthentication.SignOut(); httpContext.Response.Redirect("~/?returnurl=" + httpContext.Request.Url.ToString()); return false; } } return true; } }我在另一個線程上讀到，當(dāng)用戶未通過身份驗證并發(fā)出ajax請求時，應(yīng)將狀態(tài)代碼設(shè)置為401（未授權(quán)），然后在js中進(jìn)行檢查并將其重定向到登錄頁面。但是，我無法正常工作：protected override void OnActionExecuting(ActionExecutingContext filterContext) { if (Request.IsAjaxRequest() && (!Request.IsAuthenticated || User == null)) { filterContext.RequestContext.HttpContext.Response.StatusCode = 401; } else { base.OnActionExecuting(filterContext); } }基本上，它將其設(shè)置為401，但隨后它將繼續(xù)執(zhí)行控制器操作，并將未設(shè)置為對象錯誤實例的對象ref拋出，然后將錯誤500返回給客戶端js。如果我更改自定義的Authorize屬性以同樣驗證ajax請求，并為未經(jīng)身份驗證的請求返回false，則使ajax請求返回我的登錄頁面，這顯然不起作用。我該如何工作？
3 回答
PIPIONE
TA貢獻(xiàn)1829條經(jīng)驗 獲得超9個贊
您可以編寫一個自定義[Authorize]屬性，該屬性將返回JSON，而不是在未經(jīng)授權(quán)訪問的情況下拋出401異常，這將允許客戶端腳本優(yōu)雅地處理場景：
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class MyAuthorizeAttribute : AuthorizeAttribute
{
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
if (filterContext.HttpContext.Request.IsAjaxRequest())
{
filterContext.Result = new JsonResult
{
Data = new
{
// put whatever data you want which will be sent
// to the client
message = "sorry, but you were logged out"
},
JsonRequestBehavior = JsonRequestBehavior.AllowGet
};
}
else
{
base.HandleUnauthorizedRequest(filterContext);
}
}
}
然后用它以及在客戶端上裝飾您的控制器/動作：
$.get('@Url.Action("SomeAction")', function (result) {
if (result.message) {
alert(result.message);
} else {
// do whatever you were doing before with the results
}
});
湖上湖
TA貢獻(xiàn)2003條經(jīng)驗 獲得超2個贊
我不會將JsonRequestBehavior更改為AllowGet。相反，我建議：
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public sealed class MyAuthorizeAttribute : AuthorizeAttribute
{
public override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
OnAuthorizationHelp(filterContext);
}
internal void OnAuthorizationHelp(AuthorizationContext filterContext)
{
if (filterContext.Result is HttpUnauthorizedResult)
{
if (filterContext.HttpContext.Request.IsAjaxRequest())
{
filterContext.HttpContext.Response.StatusCode = 401;
filterContext.HttpContext.Response.End();
}
}
}
}
并添加全局js ajax錯誤處理程序：
$(document).ajaxError(function (xhr, props) {
if (props.status === 401) {
location.reload();
}
}
- 3 回答
- 0 關(guān)注
- 631 瀏覽
添加回答
舉報
0/150
提交
取消