Allow Multiple Providers with Authorize Attribute

Question

I’m trying to implement permissioning by Roles within my controller:

   [PerfilFiltro(Roles = "Administrador,Caixa")]
   public ActionResult Index()
    {
        return View(db.Adicional.ToList());
    } 

 

 public class PerfilFiltro : AuthorizeAttribute
{

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);

        if (filterContext.Result is HttpUnauthorizedResult)
            filterContext.HttpContext.Response.Redirect("/Home/Negado");
    }


}

I want to do it this way:
*The Administrator OR box profiles can open the Index.
What happens when I put between commas is that the role of the logged in user must be administrator and cashier, but I want administrator or cashier.

Answer 1

Apparently everything is ok, but just in case, if you want to test the validation behavior, try reimplementing the method AuthorizeCore and debug inside it:

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    var isAuthorized = base.AuthorizeCore(httpContext);
    return isAuthorized;
}

By the way, you can modify this method and implement the behavior you want, if you deem it necessary.