您能否为控制器启用[授权],但为单个操作禁用它?

您可以用[Authorize]修饰控制器,然后用[AllowAnonymous]修饰要豁免的方法

我不认为您可以使用标准的Authorize属性来实现这一点,但是您可以从AuthorizeAttribute派生您自己的属性,该属性接受要允许的操作列表,并且只允许访问这些操作。您可以查看authorized属性的源代码 www.codeplex.com 关于如何做到这一点的想法。如果您这样做了,它可能看起来像:

[AdminAuthorize (Roles = "Administrator", Exempt = "Login, Logout") ]
public class AdminController : Controller
{
    public ActionResult Login()
    {
        return View();
    }

    public ActionResult Login()
    {
        return View();
    }

    ... other, restricted actions ...
}

编辑 [Public] 应用于动作或控制器。如有必要,还可以应用更具体的授权。请访问我的博客 http://farm-fresh-code.blogspot.com/2011/04/default-authorization-filter-provider.html

    protected override void OnAuthorization(AuthorizationContext filterContext)
    {
        if ((string)(filterContext.RouteData.Values["action"]) == "Login")
        {
            filterContext.Cancel = true;
            filterContext.Result = Login();
        }
    }

用于测试的完整类代码:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using System.Web.Mvc.Ajax;

namespace MvcApplication2.Controllers
{
[HandleError]
[Authorize]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        ViewData["Title"] = "Home Page";
        ViewData["Message"] = "Welcome to ASP.NET MVC!";

        return View();
    }


    public ActionResult About()
    {
        ViewData["Title"] = "About Page";

        return View();
    }


    protected override void OnAuthorization(AuthorizationContext filterContext)
    {
        if ((string)(filterContext.RouteData.Values["action"]) == "Index")
        {
            filterContext.Cancel = true;
            filterContext.Result = Index();
        }
    }
}
}

public class SelectableAuthorizeAttribute : AuthorizeAttribute
{
    public SelectableAuthorizeAttribute(params Type[] typesToExclude)
    {
        _typesToExlude = typesToExclude;
    }

    private readonly Type[] _typesToExlude;

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        bool skipAuthorization = _typesToExlude.Any(type => filterContext.ActionDescriptor.ControllerDescriptor.ControllerType == type);

        if (!skipAuthorization)
        {
            base.OnAuthorization(filterContext);
        }
    }
}

filters.Add(new SelectableAuthorizeAttribute(typeof(MyController)));

希望它对某人有用