Asp.net MVC4：对控制器和操作均进行授权

Question

如果我在控制器和操作上都具有Authorize属性，哪个将生效？还是会同时生效？

Answer 1

我想向覆盖[授权]添加一些内容（案例2）

OverrideAuthorizeAttribute和DefaultAuthorizeAttribute可以正常工作，但是我发现您还可以使用OverrideAuthorizationAttribute来覆盖更高级别定义的授权过滤器。

[Authorize(Roles="user")]

public class HomeController : Controller {

    // Available to accounts in the "user" role

    public ActionResult AllUsersIndex() {

        return View();

    }

    // Available only to accounts both in the "user" and "admin" role

    [Authorize(Roles = "admin")]

    public ActionResult AdminUsersIndex() {

        return View();

    }

    // Available to accounts in the "superuser" role even if not in "user" role

    [OverrideAuthorization()]

    [Authorize(Roles = "superuser")]

    public ActionResult SuperusersIndex() {

        return View();

    }

}