控制方法只有相应权限才可执行

 1 using System;
 2 using System.Collections.Generic;
 3 using System.Security.Claims;
 4 using System.Security.Permissions;
 5 using System.Threading;
 6 
 7 namespace ApiSecurityTest
 8 {
 9     class Program
10     {
11         static void Main(string[] args)
12         {
13             var claims = new List<Claim>()
14             {
15                 new Claim(ClaimTypes.Name, "badri"),
16                 new Claim(ClaimTypes.Email, "badri@nowhere.com"),
17                 new Claim(ClaimTypes.Role, "StoreMandager"),
18                 new Claim(ClaimTypes.Role, "BackOfficeClerk")
19             };
20 
21             var id = new ClaimsIdentity(claims, "Dummy"); // Non-empty string is needed as authentication type
22             var principal = new ClaimsPrincipal(new[] { id });
23             Thread.CurrentPrincipal = principal;
24 
25             MakeDiscount();
26 
27             Console.WriteLine();
28             Console.ReadLine();
29         }
30 
31         [PrincipalPermission(SecurityAction.Demand, Role = "StoreManager")] // Declarative
32         private static void MakeDiscount()
33         {
34             try
35             {
36                 Console.WriteLine(Thread.CurrentPrincipal.IsInRole("StoreManager"));
37                 Console.WriteLine("Discount of 10% has been applied");
38             }
39             catch
40             {
41                 Console.WriteLine("no access");
42             }
43         }
44     }
45 }