DavidParks8 / Owin-Authorization

Backport of Asp.Net core's policy based authorization to Asp.Net 4
Other
60 stars 16 forks source link

Item has already been added. Key in dictionary: 'Owin.AuthorizationController' Key being added: 'Owin.AuthorizationController' #58

Closed dgwaldo closed 5 years ago

dgwaldo commented 5 years ago

The above error seems to occur if you have a controller action that calls child actions when creating the layout. If both actions use the same policy in the same controller the ResourceAuthorizeAttribute is adding the same key to the HttpContext.

Example Code to trigger this scenario: ` [ResourceAuthorize(Policy = PolicyType.HasPigsAndGoats)] public class TagsController : BaseController {

    public ActionResult Index() {
        var model = new FakeModel();
        return View(model);
    }

            [ChildActionOnly]
            public ActionResult Goats(){
                  var model = new FakeGoat();
                  return PartialView(model);
            }

} `

Index.cshtml would have something like this...

Pigs are here, goats are loading through the child action

@Html.Action("Goats")

I believe this happens because of line 33 in ResourceAuthorizeAttribute...

filterContext.HttpContext.Items.Add(s_controllerKey, filterContext.Controller);

Could the s_controllerKey variable be based on the controller and action names? Maybe that's an over simplification? Or perhaps it would be enough to just check and see if the key is already there?

DavidParks8 commented 5 years ago

Good find. I'll apply a simple fix to remediate the issue.

DavidParks8 commented 5 years ago

The fix is available in version 1.1.1.1