的WebAPI多重矛盾的途径 - 验证的基于

Question

我有担任了活动的控制器。所述控制器提供路径GET => /Events将返回活动的阵列。

该控制器可以用于活动到3种不同类型的认证。 Admin，Api和User。

如果请求者被认证为User我想回到事件对象，但范围的用户。例如

class Event { 
public string Title { get; set; } 
} 

class EventView { 
    public string Title { get; set; } 
    public bool RSVPed { get; set; } 
} 

我怎样才能使这成为可能在我的控制器 -

[RoutePrefix("Events")] 
class EventsController { 

    [@Authorize(AuthenticationType.Admin, AuthenticationType.Api)] 
    [HttpGet] 
    [Route("")] 
    public async Task<IHttpActionResult> Get() { } 

    [@Authorize(AuthenticationType.User)] 
    [HttpGet] 
    [Route("")] 
    public async Task<IHttpActionResult> Get() { } 
} 

Answer 1

与所有允许的权限一个动作。在您根据授权委托人执行期望行为的行为中。

[RoutePrefix("Events")] 
public class EventsController : ApiController { 

    [Authorize(AuthenticationType.Admin, AuthenticationType.Api, AuthenticationType.User)] 
    [HttpGet] 
    [Route("")] //Matches GET => /Events 
    public async Task<IHttpActionResult> Get() { 
     var user = User.Identity; 
     if(user.AuthenticationType == AuthenticationType.User) { 
      //...User specific code 
     } else { 
      //...Admin, API specific code 
     } 
    } 

} 

其他明智的你必须使路线独特，以免互相冲突。

[RoutePrefix("Events")] 
public class EventsController : ApiController { 

    [Authorize(AuthenticationType.Admin, AuthenticationType.Api)] 
    [HttpGet] 
    [Route("")] //Matches GET => /Events 
    public async Task<IHttpActionResult> Get() { 
     //... 
    } 

    [Authorize(AuthenticationType.User)] 
    [HttpGet] 
    [Route("{id:int}")] //Matches GET => /Events/12345 
    public async Task<IHttpActionResult> Get(int id) { 
     //... 
    } 
}