在ASP.NET MVC Beta中通过IP地址限制对特定控制器的访问

public class IPAddressFilterAttribute : ActionFilterAttribute
{
    private readonly string[] _allowedIPAddresses;

    public IPAddressFilterAttribute(string[] allowedIPAddresses)
    {
        _allowedIPAddresses = allowedIPAddresses;
    }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var request = filterContext.HttpContext.Request;
        var remoteIPAddress = request.ServerVariables["HTTP_X_FORWARDED_FOR"];

        if (string.IsNullOrEmpty(remoteIPAddress))
        {
            remoteIPAddress = request.ServerVariables["REMOTE_ADDR"];
        }

        if (!_allowedIPAddresses.Contains(remoteIPAddress))
        {
            filterContext.Result = new HttpStatusCodeResult(HttpStatusCode.Forbidden);
        }

        base.OnActionExecuting(filterContext);
    }
}

[IPAddressFilter(new[] { "192.168.0.1", "10.0.0.1" })]
public class RestrictedController : Controller
{
    // ...
}

public class RestrictedController : Controller
{
    [IPAddressFilter(new[] { "192.168.0.1", "10.0.0.1" })]
    public ActionResult RestrictedAction()
    {
        // ...
    }
}