huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

AllowAnonymous can override AuthorizeAttribute 

#309
This commit is contained in:
Sebastien Ros 2014-04-28 10:57:20 -07:00
parent e5aeb738e3
commit b3046a0285
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Microsoft.AspNet.Mvc.Core/Filters/AuthorizeAttribute.cs
View File

@ -50,7 +50,7 @@ namespace Microsoft.AspNet.Mvc
user.Identity == null ||
!user.Identity.IsAuthenticated;
if(userIsAnonymous)
if(userIsAnonymous && !HasAllowAnonymous(context))
{
base.Fail(context);
}

20
test/Microsoft.AspNet.Mvc.Core.Test/Filters/AuthorizeAttributeTests.cs
View File

@ -45,6 +45,26 @@ namespace Microsoft.AspNet.Mvc.Core.Test
Assert.NotNull(authorizationContext.Result);
}
[Fact]
public async Task Invoke_EmptyClaimsWithAllowAnonymousAttributeShouldNotRejectAnonymousUser()
{
// Arrange
var authorizationService = new DefaultAuthorizationService(Enumerable.Empty<IAuthorizationPolicy>());
var authorizeAttribute = new AuthorizeAttribute();
var authorizationContext = GetAuthorizationContext(services =>
services.AddInstance<IAuthorizationService>(authorizationService),
anonymous: true
);
authorizationContext.Filters.Add(new AllowAnonymousAttribute());
// Act
await authorizeAttribute.OnAuthorizationAsync(authorizationContext);
// Assert
Assert.Null(authorizationContext.Result);
}
[Fact]
public async Task Invoke_EmptyClaimsShouldAuthorizeAuthenticatedUser()
{