Question

When making a custom [Authorize] attribute is there a way to catch what Role that is being requested?

So in the case of [Auth(Roles = "IgnoreAuth")] is there a way inside of the custom Auth to catch "IgnoreAuth" somehow?

Answer 1

Roles is in the base AuthorizeAttribute class. So you can simply access it from your custom Auth like this:

public class AuthAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var roles = this.Roles;
    }
}

Just to clarify, whenever you do [Auth(Roles = “IgnoreAuth”)], you’re just setting the Roles property in the AuthorizeAttribute.