.net – 默认情况下如何拒绝Web API项目的授权

config.Filters.Add(new DenyAuthorizationAttribute());   // ??

public class ExampleController : ApiController
{
    [Authorize(Roles = "Admins")]
    public String GetHello_OnlyAdmins()
    {
        // only admins can call this
    }

    [AllowAnonymous]
    public void PostSomething_Everybody()
    {
        // ...
    }

    public void deleteSomething_NoOne()        
    {
        // nobody can call this - we want to force the progrAMMer to be specific about authorized roles
    }

}

我通过向httpConfiguration.Filters添加custuR_225_11845@“default deny”授权过滤器来解决这个问题：

public class DefaultDenyAuthorizationFilter : AuthorizeAttribute
{
    public override void OnAuthorization(httpActionContext actionContext)
    {
        if ( null == actionContext )
            throw new ArgumentNullException("actionContext");

        if ( actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any() ||
             actionContext.ActionDescriptor.GetCustomAttributes<AuthorizeAttribute>().Any() ||
             actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any() ||
             actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AuthorizeAttribute>().Any() )
            return;

        base.HandleUnauthorizedrequest(actionContext);
    }
}