如何在ASP.NET Core视图中使用自定义授权属性？

你已经在控制器里实现了自定义的PermissionAttribute来校验用户角色对应的权限，现在想把这套逻辑搬到视图里，避免重复造轮子对吧？下面是一个完美的解决方案，能让你复用现有权限校验逻辑，不用切换到策略授权的思路。

先理清楚你的现有代码情况 #

控制器里的权限验证用法 #

[Permission("test")]
public IActionResult Index() { return View(); }

自定义PermissionAttribute和过滤器实现 #

public class PermissionAttribute : TypeFilterAttribute {
 public PermissionAttribute(params string[] permission) : base(typeof(PermissionRequirementFilter)) {
 Arguments = new object[] { permission };
 }
}

public class PermissionRequirementFilter : IAuthorizationFilter {
 readonly string[] _permission;
 private readonly ApplicationDbContext _db;
 private readonly UserManager<ApplicationUser> _userManager;
 private readonly ILogger<ExternalLoginModel> _logger;

 public PermissionRequirementFilter(ApplicationDbContext db, UserManager<ApplicationUser> userManager, ILogger<ExternalLoginModel> logger, params string[] permission) {
 _db = db;
 _userManager = userManager;
 _logger = logger;
 _permission = permission;
 }

 public void OnAuthorization(AuthorizationFilterContext context) {
 if (!IsUserAuthenticated(context)) {
 context.Result = new UnauthorizedResult();
 return;
 }

 var id = _userManager.GetUserId(context.HttpContext.User);
 var user = _db.Users.Include(e => e.UserRoles)
 .ThenInclude(c => c.Role)
 .ThenInclude(c => c.Permissions)
 .ThenInclude(c => c.Permission)
 .FirstOrDefault(c => c.Id == id);

 if (user != null) {
 var userRole = user.UserRoles.Select(c => c.Role).ToList();
 var permissions = userRole.SelectMany(c => c.Permissions.Select(e => e.Permission.Label)).ToList();
 if (permissions.Any(c => _permission.Contains(c))) {
 _logger.LogInformation("succedd.");
 return;
 }
 }

 _db.Dispose();
 context.Result = new ForbidResult();
 }

 // 假设你有这个判断用户是否认证的方法
 private bool IsUserAuthenticated(AuthorizationFilterContext context)
 {
 return context.HttpContext.User.Identity.IsAuthenticated;
 }
}

你之前尝试的视图授权方式（基于策略） #

@if (await AuthorizationService.AuthorizeAsync(User, Model, "test")) {
 <a href="calendar.html" class="waves-effect">
 <i class="ti-calendar"></i><span> Calendar</span>
 </a>
 ... ...
}

解决方案：封装权限服务，复用逻辑 #

核心思路是把过滤器里的权限校验逻辑抽离成一个可注入的服务，这样控制器过滤器和视图都能共用同一套代码，避免重复。

步骤1：创建IPermissionService接口和实现类 #

把原来过滤器里的校验逻辑移到这个服务里：

public interface IPermissionService
{
 Task<bool> HasPermissionAsync(ClaimsPrincipal user, params string[] requiredPermissions);
}

public class PermissionService : IPermissionService
{
 private readonly ApplicationDbContext _db;
 private readonly UserManager<ApplicationUser> _userManager;
 private readonly ILogger<PermissionService> _logger;

 public PermissionService(ApplicationDbContext db, UserManager<ApplicationUser> userManager, ILogger<PermissionService> logger)
 {
 _db = db;
 _userManager = userManager;
 _logger = logger;
 }

 public async Task<bool> HasPermissionAsync(ClaimsPrincipal user, params string[] requiredPermissions)
 {
 // 先判断用户是否已认证
 if (!user.Identity.IsAuthenticated)
 return false;

 // 获取用户ID，查询关联的角色和权限
 var userId = _userManager.GetUserId(user);
 var userWithRoles = await _db.Users
 .Include(u => u.UserRoles)
 .ThenInclude(ur => ur.Role)
 .ThenInclude(r => r.Permissions)
 .ThenInclude(rp => rp.Permission)
 .FirstOrDefaultAsync(u => u.Id == userId);

 if (userWithRoles == null)
 return false;

 // 提取用户所有权限标签
 var userPermissions = userWithRoles.UserRoles
 .SelectMany(ur => ur.Role.Permissions)
 .Select(rp => rp.Permission.Label)
 .ToList();

 // 检查是否包含任一所需权限
 var hasPermission = requiredPermissions.Any(reqPerm => userPermissions.Contains(reqPerm));

 if (hasPermission)
 _logger.LogInformation("用户权限验证通过");

 return hasPermission;
 }
}

步骤2：更新过滤器，复用PermissionService #

现在过滤器不用自己写查询逻辑了，直接调用服务即可，代码更简洁：

public class PermissionRequirementFilter : IAuthorizationFilter
{
 readonly string[] _requiredPermissions;
 private readonly IPermissionService _permissionService;

 // 依赖注入PermissionService
 public PermissionRequirementFilter(IPermissionService permissionService, params string[] requiredPermissions)
 {
 _permissionService = permissionService;
 _requiredPermissions = requiredPermissions;
 }

 public async void OnAuthorization(AuthorizationFilterContext context)
 {
 var hasPermission = await _permissionService.HasPermissionAsync(context.HttpContext.User, _requiredPermissions);

 if (!hasPermission)
 {
 // 根据认证状态返回不同结果
 context.Result = context.HttpContext.User.Identity.IsAuthenticated 
 ? new ForbidResult() 
 : new UnauthorizedResult();
 }
 }
}

同时更新PermissionAttribute，确保依赖注入能正常工作：

public class PermissionAttribute : TypeFilterAttribute
{
 public PermissionAttribute(params string[] permission) : base(typeof(PermissionRequirementFilter))
 {
 Arguments = new object[] { permission };
 // DI容器会自动注入IPermissionService，不用手动传
 }
}

别忘了在你的DI配置里注册这个服务（比如Program.cs或Startup.cs）：

services.AddScoped<IPermissionService, PermissionService>();

步骤3：在视图中使用PermissionService #

首先在视图顶部注入服务：

@inject IPermissionService PermissionService

然后就可以直接调用服务来验证权限了：

@if (await PermissionService.HasPermissionAsync(User, "test"))
{
 <a href="calendar.html" class="waves-effect">
 <i class="ti-calendar"></i><span> Calendar</span>
 </a>
 <!-- 其他有权限才能显示的内容 -->
}

可选优化：自定义HTML Helper #

如果觉得每次写await PermissionService.HasPermissionAsync太啰嗦，可以写个HTML Helper简化调用：

public static class PermissionHtmlHelpers
{
 public static async Task<bool> HasPermission(this IHtmlHelper htmlHelper, ClaimsPrincipal user, params string[] permissions)
 {
 var service = htmlHelper.ViewContext.HttpContext.RequestServices.GetService<IPermissionService>();
 return await service.HasPermissionAsync(user, permissions);
 }
}

然后在视图里就能这样用：

@if (await Html.HasPermission(User, "test"))
{
 <!-- 有权限显示的内容 -->
}

为什么这个方案更好？ #

1. 完全复用现有逻辑：不用重新配置策略授权，直接把你已经写好的权限查询逻辑抽离出来，避免代码重复。
2. 统一维护：以后要修改权限校验逻辑，只需要改PermissionService一处即可，控制器和视图都会同步更新。
3. 更灵活：支持多权限校验（比如HasPermissionAsync(User, "test", "manage")），满足复杂场景。

内容的提问来源于stack exchange，提问作者khayyam