ASP.NET Core MVC 2.1如何基于用户动态配置授权策略？

针对你的场景——需要根据用户动态加载授权策略（支持运行时修改），而非在Startup阶段固定注册，我给你一套实用的落地方案：

1. 定义动态授权需求与处理程序 #

首先我们需要创建通用的授权需求类，用来承载不同策略的条件（比如周一限制、时段限制）：

public class DynamicAccessRequirement : IAuthorizationRequirement
{
    // 存储当前用户对应的授权规则集合
    public List<AccessRule> Rules { get; set; } = new();
}

// 定义具体的规则类型与参数
public class AccessRule
{
    public RuleType Type { get; set; }
    // 针对不同规则的参数（比如时段规则的起止时间）
    public string? Parameters { get; set; }
}

public enum RuleType
{
    AllowOnlyMonday,
    AllowSpecificTimeWindow,
    DenyAll
}

接下来写对应的授权处理程序，负责解析规则并判断是否授权：

public class DynamicAccessHandler : AuthorizationHandler<DynamicAccessRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, DynamicAccessRequirement requirement)
    {
        var now = DateTime.Now;
        foreach (var rule in requirement.Rules)
        {
            switch (rule.Type)
            {
                case RuleType.AllowOnlyMonday:
                    if (now.DayOfWeek != DayOfWeek.Monday)
                    {
                        // 非周一，直接拒绝授权
                        context.Fail();
                        return Task.CompletedTask;
                    }
                    break;
                case RuleType.AllowSpecificTimeWindow:
                    if (!TryParseTimeWindow(rule.Parameters, out var startTime, out var endTime))
                    {
                        context.Fail();
                        return Task.CompletedTask;
                    }
                    var currentTime = now.TimeOfDay;
                    if (currentTime < startTime || currentTime > endTime)
                    {
                        context.Fail();
                        return Task.CompletedTask;
                    }
                    break;
                case RuleType.DenyAll:
                    context.Fail();
                    return Task.CompletedTask;
            }
        }

        // 所有规则校验通过
        context.Succeed(requirement);
        return Task.CompletedTask;
    }

    private bool TryParseTimeWindow(string? parameters, out TimeSpan startTime, out TimeSpan endTime)
    {
        startTime = TimeSpan.Zero;
        endTime = TimeSpan.Zero;
        if (string.IsNullOrEmpty(parameters)) return false;
        
        var parts = parameters.Split('-');
        return parts.Length == 2 && 
               TimeSpan.TryParse(parts[0], out startTime) && 
               TimeSpan.TryParse(parts[1], out endTime);
    }
}

2. 注册授权服务 #

在Program.cs（或Startup.cs）里，把自定义的处理程序注册到DI容器：

builder.Services.AddAuthorization();
builder.Services.AddScoped<IAuthorizationHandler, DynamicAccessHandler>();

3. 在控制器动作中动态应用策略 #

现在你可以在控制器动作里，根据当前用户加载对应的授权规则，调用IAuthorizationService执行授权检查：

[ApiController]
[Route("api/[controller]")]
public class ProtectedController : ControllerBase
{
    private readonly IAuthorizationService _authorizationService;
    // 假设你有一个服务用来读取用户的授权规则（可从数据库/缓存获取，支持运行时修改）
    private readonly IUserAccessRuleService _userAccessRuleService;

    public ProtectedController(IAuthorizationService authorizationService, IUserAccessRuleService userAccessRuleService)
    {
        _authorizationService = authorizationService;
        _userAccessRuleService = userAccessRuleService;
    }

    [HttpGet("sensitive-data")]
    public async Task<IActionResult> GetSensitiveData()
    {
        var userId = User.Identity?.Name;
        if (string.IsNullOrEmpty(userId))
        {
            return Unauthorized();
        }

        // 实时获取用户当前的授权规则（数据库修改后立即生效）
        var userRules = await _userAccessRuleService.GetRulesForUserAsync(userId);
        
        // 构造动态授权需求
        var requirement = new DynamicAccessRequirement
        {
            Rules = userRules
        };

        // 执行授权校验
        var authResult = await _authorizationService.AuthorizeAsync(User, requirement);
        if (!authResult.Succeeded)
        {
            return Forbid();
        }

        // 授权通过，返回业务数据
        return Ok("敏感数据内容");
    }
}

4. 扩展：用自定义属性简化动作代码 #

如果不想每个动作都写重复的授权逻辑，可以封装一个自定义的DynamicAuthorizeAttribute：

public class DynamicAuthorizeAttribute : Attribute, IAuthorizationFilter
{
    private readonly IAuthorizationService _authorizationService;
    private readonly IUserAccessRuleService _userAccessRuleService;

    // 构造函数通过DI注入依赖服务
    public DynamicAuthorizeAttribute(IAuthorizationService authorizationService, IUserAccessRuleService userAccessRuleService)
    {
        _authorizationService = authorizationService;
        _userAccessRuleService = userAccessRuleService;
    }

    public async void OnAuthorization(AuthorizationFilterContext context)
    {
        var user = context.HttpContext.User;
        if (!user.Identity?.IsAuthenticated ?? true)
        {
            context.Result = new UnauthorizedResult();
            return;
        }

        var userId = user.Identity.Name;
        var userRules = await _userAccessRuleService.GetRulesForUserAsync(userId!);
        var requirement = new DynamicAccessRequirement { Rules = userRules };
        
        var authResult = await _authorizationService.AuthorizeAsync(user, requirement);
        if (!authResult.Succeeded)
        {
            context.Result = new ForbidResult();
        }
    }
}

之后在控制器动作上直接标记即可：

[HttpGet("sensitive-data")]
[DynamicAuthorize]
public IActionResult GetSensitiveData()
{
    return Ok("敏感数据内容");
}

关键优势 #

• 完全动态：用户的授权规则可随时通过数据库/配置修改，无需重启应用，实时生效；
• 灵活扩展：新增授权规则时，只需扩展RuleType枚举和处理程序逻辑即可；
• 精细化控制：可针对单个控制器动作应用专属的动态检查逻辑，满足复杂业务场景。

内容的提问来源于stack exchange，提问作者user2484998