CODEWITHSUNDEEP
asp.net-mvc-3
vietvoquoc
vietvoquoc

Reputation: 833

How Authorize attribute work in MVC3

I research about mvc3 and i read alot article or watch video on asp.net website. After i have some knowledge about mvc3 and so i have question about Authorize attribute to authenticate user is login or not. The default code when i create a page to authenticate user like this:

[HttpPost]
    public ActionResult LogOn(LogOnModel model, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            if (Membership.ValidateUser(model.UserName, model.Password))
            {
                FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                    && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                {
                    return Redirect(returnUrl);
                }
                else
                {
                    return RedirectToAction("Index", "Home");
                }
            }
            else
            {
                ModelState.AddModelError("", "The user name or password provided is incorrect.");
            }
        }

        // If we got this far, something failed, redisplay form
        return View(model);
    }

If i don't want to use Membership and FormsAuthentication (Don't say about windows authentication) to authorize for user. So is there any way to create something to authenticate user and when i use Authorize attribute it will work like when i use Membership and FormsAuthentication. I don't know what Authorize attribute use to authenticate user is login or not, from that i can create a session or cookie by myself to authenticate user. If my question not clear , please let me know! Thanks for reading!

Upvotes: 1

Views: 2018

Answers (1)

Richard
Richard

Reputation: 22036

What you can do is roll your own authorise attribute like this:

public class AuthorizeAttribute : System.Web.Mvc.AuthorizeAttribute
{

    protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
    {
        //Put your authorisation check here
    }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        //put your redirect to login controller here
    }
}

Upvotes: 3

Related Questions