Asp.net MVC4：对控制器和操作均进行授权

Question

如果我在控制器和操作上都具有Authorize属性，哪个将生效？还是会同时生效？

Answer 1

我想向覆盖[授权]添加一些内容（案例2）OverrideAuthorizeAttribute和DefaultAuthorizeAttribute可以正常工作，但是我发现您还可以使用OverrideAuthorizationAttribute来覆盖更高级别定义的授权过滤器。[Authorize(Roles="user")]public class HomeController : Controller {    // Available to accounts in the "user" role    public ActionResult AllUsersIndex() {        return View();    }    // Available only to accounts both in the "user" and "admin" role    [Authorize(Roles = "admin")]    public ActionResult AdminUsersIndex() {        return View();    }    // Available to accounts in the "superuser" role even if not in "user" role    [OverrideAuthorization()]    [Authorize(Roles = "superuser")]    public ActionResult SuperusersIndex() {        return View();    }}