asp.net-mvc ASP.NET MVC 角色授权
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/780715/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
ASP.NET MVC Roles Authorization
提问by Mr Grok
I want to make the roles default for my controller class to "Administrators, Content Editors"
我想将我的控制器类的角色默认设置为“管理员、内容编辑器”
[Authorize(Roles = "Administrators, Content Editor")]
I've done this by adorning the controller with the attribute above. However, there is one action that I want to be available to all (namely "View"). How can I reset the Roles so that everyone (including completely unauthorized users) have access for this action.
我通过用上面的属性装饰控制器来做到这一点。但是，我希望所有人都可以使用一项操作（即“查看”）。我如何重置角色，以便每个人（包括完全未经授权的用户）都可以访问此操作。
Note: I know I could adorn every single action other action with the authorize attribute above but I don't want to have to do that all the time. I want all of the controllers actions to be unacessible by default so that if anyone adds an action they have to make a considered decision to make it available to the general public.
注意：我知道我可以用上面的 authorize 属性装饰其他动作的每一个动作，但我不想一直这样做。我希望所有控制器的动作在默认情况下都是不可访问的，这样如果有人添加一个动作，他们必须做出深思熟虑的决定，使其对公众可用。
采纳答案by Simon_Weaver
MVC4 has a new attribute exactly meant for this [AllowAnonymous]
MVC4 有一个专门用于此的新属性 [AllowAnonymous]
[AllowAnonymous]
public ActionResult Register()
回答by Kieron
You can place the Authorize attribute on the action methods. Not just at the class level.
您可以将 Authorize 属性放在操作方法上。不仅仅是在班级。
So, move the attribute from the controller class to just the action methods you want to secure.
因此，将属性从控制器类移动到您想要保护的操作方法。
回答by Mr Grok
The only solution I can think of so far is to create and register another controller so that I have one for anonymous access, and one for authorized access but that's not quite as elegant as I would have liked.
到目前为止，我能想到的唯一解决方案是创建和注册另一个控制器，以便我有一个用于匿名访问，一个用于授权访问，但这并不像我希望的那样优雅。
