Web用户的身份验证及WebApi权限验证流程的设计和实现

public class AccountController : Controller  
    {  
        //  
        // GET: /Logon/  
  
        public ActionResult Login(string returnUrl)  
        {  
            ViewBag.ReturnUrl = returnUrl;  
            return View();  
        }  
  
        [HttpPost]  
        public ActionResult Logon(LoginUser loginUser, string returnUrl)  
        {  
            string strUserName = loginUser.UserName;  
            string strPassword = loginUser.Password;  
            var accountModel = new AccountModel();  
  
            //验证用户是否是系统注册用户  
            if (accountModel.ValidateUserLogin(strUserName, strPassword))  
            {  
                if (Url.IsLocalUrl(returnUrl))  
                {  
                    //创建用户ticket信息  
                    accountModel.CreateLoginUserTicket(strUserName, strPassword);  
  
                    //读取用户权限数据  
                    accountModel.GetUserAuthorities(strUserName);  
  
                    return new RedirectResult(returnUrl);  
                }  
                else  
                {  
                    return RedirectToAction("Index", "Home");  
                }                 
            }  
            else  
            {  
                throw new ApplicationException("无效登录用户！");  
            }  
        }  
  
        /// <summary>  
        /// 用户注销，注销之前，清除用户ticket  
        /// </summary>  
        /// <returns></returns>  
        [HttpPost]  
        public ActionResult Logout()  
        {  
            var accountModel = new AccountModel();  
            accountModel.Logout();  
  
            return RedirectToAction("Login", "Account");  
        }  
    }

public class AccountModel  
    {  
        /// <summary>  
        /// 创建登录用户的票据信息  
        /// </summary>  
        /// <param name="strUserName"></param>  
        internal void CreateLoginUserTicket(string strUserName, string strPassword)  
        {  
            //构造Form验证的票据信息  
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, strUserName, DateTime.Now, DateTime.Now.AddMinutes(90),  
                true, string.Format("{0}:{1}", strUserName, strPassword), FormsAuthentication.FormsCookiePath);  
  
            string ticString = FormsAuthentication.Encrypt(ticket);  
  
            //把票据信息写入Cookie和Session  
            //SetAuthCookie方法用于标识用户的Identity状态为true  
            HttpContext.Current.Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, ticString));  
            FormsAuthentication.SetAuthCookie(strUserName, true);  
            HttpContext.Current.Session["USER_LOGON_TICKET"] = ticString;  
              
            //重写HttpContext中的用户身份，可以封装自定义角色数据；  
            //判断是否合法用户，可以检查：HttpContext.User.Identity.IsAuthenticated的属性值  
            string[] roles = ticket.UserData.Split(‘,‘);  
            IIdentity identity = new FormsIdentity(ticket);  
            IPrincipal principal = new GenericPrincipal(identity, roles);  
            HttpContext.Current.User = principal;  
        }  
  
        /// <summary>  
        /// 获取用户权限列表数据  
        /// </summary>  
        /// <param name="userName"></param>  
        /// <returns></returns>  
        internal string GetUserAuthorities(string userName)  
        {  
            //从WebApi 访问用户权限数据，然后写入Session  
            string jsonAuth = "[{\"Controller\": \"SampleController\", \"Actions\":\"Apply,Process,Complete\"}, {\"Controller\": \"Product\", \"Actions\": \"List,Get,Detail\"}]";  
            var userAuthList = ServiceStack.Text.JsonSerializer.DeserializeFromString(jsonAuth, typeof(UserAuthModel[]));  
            HttpContext.Current.Session["USER_AUTHORITIES"] = userAuthList;  
  
            return jsonAuth;  
        }  
  
        /// <summary>  
        /// 读取数据库用户表数据，判断用户密码是否匹配  
        /// </summary>  
        /// <param name="name"></param>  
        /// <param name="password"></param>  
        /// <returns></returns>  
        internal bool ValidateUserLogin(string name, string password)  
        {  
            //bool isValid = password == passwordInDatabase;  
            return true;  
        }  
  
        /// <summary>  
        /// 用户注销执行的操作  
        /// </summary>  
        internal void Logout()  
        {  
            FormsAuthentication.SignOut();  
        }  
    }

/// <summary>  
    /// 前端Mvc控制器基类  
    /// </summary>  
    [Authorize]  
    public abstract class WebControllerBase : Controller  
    {  
        /// <summary>  
        /// 对应api的Url  
        /// </summary>  
        public string ApiUrl  
        {  
            get;  
            protected set;  
        }  
  
        /// <summary>  
        /// 用户权限列表  
        /// </summary>  
        public UserAuthModel[] UserAuthList  
        {  
            get  
            {  
                return AuthorizedUser.Current.UserAuthList;  
            }  
        }  
  
        /// <summary>  
        /// 登录用户票据  
        /// </summary>  
        public string UserLoginTicket  
        {  
            get  
            {  
                return AuthorizedUser.Current.UserLoginTicket;  
            }  
        }  
    }

/// <summary>  
    /// 权限验证属性类  
    /// </summary>  
    public class RequireAuthorizeAttribute : AuthorizeAttribute  
    {  
        /// <summary>  
        /// 用户权限列表  
        /// </summary>  
        public UserAuthModel[] UserAuthList  
        {  
            get  
            {  
                return AuthorizedUser.Current.UserAuthList;  
            }  
        }  
  
        /// <summary>  
        /// 登录用户票据  
        /// </summary>  
        public string UserLoginTicket  
        {  
            get  
            {  
                return AuthorizedUser.Current.UserLoginTicket;  
            }  
        }  
  
        public override void OnAuthorization(AuthorizationContext filterContext)  
        {  
            base.OnAuthorization(filterContext);  
  
            ////验证是否是登录用户  
            var identity = filterContext.HttpContext.User.Identity;  
            if (identity.IsAuthenticated)  
            {  
                var actionName = filterContext.ActionDescriptor.ActionName;  
                var controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;  
  
                //验证用户操作是否在权限列表中  
                if (HasActionQulification(actionName, controllerName, identity.Name))  
                    if (!string.IsNullOrEmpty(UserLoginTicket))  
                        //有效登录用户，有权限访问此Action，则写入Cookie信息  
                        filterContext.HttpContext.Response.Cookies[FormsAuthentication.FormsCookieName].Value = UserLoginTicket;  
                    else  
                        //用户的Session, Cookie都过期，需要重新登录  
                        filterContext.HttpContext.Response.Redirect("~/Account/Login", false);  
                else  
                    //虽然是登录用户，但没有该Action的权限，跳转到“未授权访问”页面  
                    filterContext.HttpContext.Response.Redirect("~/Home/UnAuthorized", true);  
            }  
            else  
            {  
                //未登录用户，则判断是否是匿名访问  
                var attr = filterContext.ActionDescriptor.GetCustomAttributes(true).OfType<AllowAnonymousAttribute>();  
                bool isAnonymous = attr.Any(a => a is AllowAnonymousAttribute);  
  
                if (!isAnonymous)  
                    //未验证（登录）的用户, 而且是非匿名访问，则转向登录页面  
                    filterContext.HttpContext.Response.Redirect("~/Account/Login", true);  
            }  
        }  
  
        /// <summary>  
        /// 从权限列表验证用户是否有权访问Action  
        /// </summary>  
        /// <param name="actionName"></param>  
        /// <param name="controllerName"></param>  
        /// <returns></returns>  
        private bool HasActionQulification(string actionName, string controllerName, string userName)  
        {  
            //从该用户的权限数据列表中查找是否有当前Controller和Action的item  
            var auth = UserAuthList.FirstOrDefault(a =>  
            {  
                bool rightAction = false;  
                bool rightController = a.Controller == controllerName;  
                if (rightController)  
                {  
                    string[] actions = a.Actions.Split(‘,‘);  
                    rightAction = actions.Contains(actionName);  
                }  
                return rightAction;  
            });  
  
            //此处可以校验用户的其它权限条件  
            //var notAllowed = HasOtherLimition(userName);  
            //var result = (auth != null) && notAllowed;  
            //return result;  
  
            return (auth != null);  
        }  
    }

public class ProductController : WebControllerBase  
{  
  
        [AllowAnonymous]  
        public ActionResult Query()  
        {  
            return View("ProductQuery");  
        }  
  
        [HttpGet]  
        //[AllowAnonymous]  
        [RequireAuthorize]  
        public ActionResult Detail(string id)  
        {  
            var cookie = HttpContext.Request.Cookies;  
            string url = base.ApiUrl + "/Get/" + id;  
            HttpClient httpClient = HttpClientHelper.Create(url, base.UserLoginTicket);  
              
            string result = httpClient.GetString();  
            var model = JsonSerializer.DeserializeFromString<Product>(result);  
            ViewData["PRODUCT_ADD_OR_EDIT"] = "E";  
            return View("ProductForm", model);  
        }  
}