AuthorizationHandler异常没有通过ExceptionFilter

我在ASP中有一个应用程序。. NET Core MVC (dnx46) RC1与AuthorizationHandler:

public class AppSumAuthAuthorizationHandler : AuthorizationHandler<AppSumAuthRequirement>
{
    private readonly IUserRepository _userRepository;
    private readonly IUserRoleRepository _userRoleRepository;
    public AppSumAuthAuthorizationHandler(IUserRepository userRepository, IUserRoleRepository userRoleRepository)
    {
        _userRepository = userRepository;
        _userRoleRepository = userRoleRepository;
    }
    protected override async void Handle(AuthorizationContext context, AppSumAuthRequirement requirement)
    {
        await HandleAsync(context,requirement);
    }
    protected override async Task HandleAsync(AuthorizationContext context, AppSumAuthRequirement requirement)
    {
        var currentUserName = context.User.Identity.Name;
        var currentUser = await _userRepository.GetAsync(u => u.UserName == context.User.Identity.Name);
        // Create user that does not yet exist
        if(currentUser == null)
        {
            var user = new User(currentUserName);
            /* Temporary add SysAdmin role */
            using(new CreatedBySystemProvider(_userRepository))
            {
                _userRepository.Add(user);
                await _userRepository.SaveChangesAsync();
                if (string.Equals(currentUserName, @"BIJTJES'NilsG", StringComparison.CurrentCultureIgnoreCase))
                {
                    user.AddRole(1);
                }
                currentUser = await _userRepository.GetAsync(u => u.Id == user.Id);
            }
        }
        var resource = (Microsoft.AspNet.Mvc.Filters.AuthorizationContext) context.Resource;
        var controllerActionDescriptor = resource.ActionDescriptor  as ControllerActionDescriptor;
        var controllerName = controllerActionDescriptor.ControllerName;
        var actionName = controllerActionDescriptor.Name;
        string moduleName;
        try
        {
            // Get the name of the module
            moduleName = ((ModuleAttribute)controllerActionDescriptor.ControllerTypeInfo.GetCustomAttributes(false).First(a => a.GetType().Name == "ModuleAttribute")).ModuleName;
        }
        catch(InvalidOperationException ex)
        {
            context.Fail();
            throw new InvalidOperationException($"The Module Attribute is required on basecontroller {controllerName}.", ex);
        }
        var access = new Access(moduleName, controllerName, actionName);
        if (await currentUser.HasPermissionTo(UrlAccessLevel.Access).OnAsync(access))
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
        }
    }
}

需求类为空:

public interface IAppSumAuthRequirement : IAuthorizationRequirement
{
}
public class AppSumAuthRequirement : IAppSumAuthRequirement
{
}

Module属性也没什么特别的:

public class ModuleAttribute : Attribute
{
    public string ModuleName { get; private set; }
    public ModuleAttribute(string moduleName)
    {
        ModuleName = moduleName;
    }
    public override string ToString()
    {
        return ModuleName;
    }
}

异常过滤器:

    public class JsonExceptionFilterAttribute : ExceptionFilterAttribute
{
    public override void OnException(ExceptionContext context)
    {
        var exception = context.Exception;
        context.HttpContext.Response.StatusCode = 500;
        context.Result = new JsonResult(new Error
        {
            Message = exception.Message,
            InnerException = exception.InnerException?.InnerException?.Message,
            Data = exception.Data,
            ErrorCode = exception.HResult,
            Source = exception.Source,
            Stacktrace = exception.StackTrace,
            ErrorType = exception.GetType().ToString()
    });
    }
}

和policy在我的Startup.cs中配置:

public IServiceProvider ConfigureServices(IServiceCollection services)
    {
        services.AddMvc(options =>
        {
            options.Filters.Add(new JsonExceptionFilterAttribute());
            options.ModelBinders.Insert(0, new NullableIntModelBinder());
        }).AddJsonOptions(options => {
            options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore;
            options.SerializerSettings.ContractResolver = new Newtonsoft.Json.Serialization.CamelCasePropertyNamesContractResolver();
        });
        // Security
        services.AddAuthorization(options =>
        {
            options.AddPolicy("AppSumAuth",
                policy => policy.Requirements.Add(new AppSumAuthRequirement()));
        });
}

，并且通过继承BaseController在所有控制器上设置策略:

[Authorize(Policy = "AppSumAuth")]
public class BaseController : Controller
{
    public BaseController()
    {
    }
}

因此，在我的处理程序中，我获得了controllername, actionname和modulename(来自控制器上的属性集):

[Module("Main")]

当此属性未在控制器上设置时，我想捕获异常并将其报告给调用控制器的开发人员并拒绝访问。为此，我添加了:

        catch(InvalidOperationException ex)
        {
            context.Fail();
            throw new InvalidOperationException($"The Module Attribute is required on basecontroller {controllerName}.", ex);
        }

当控制器中有异常时，JsonExceptionFilter被完美地调用。然而，当AuthorizationHandler中出现错误时，它不会被调用。

---

所以问题是:

我怎样才能得到由JsonExceptionFilter捕获的异常?我做错了什么?

<标题>解决方案:

Startup.cs:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        // For Windows Auth!
        app.UseIISPlatformHandler();
        app.UseStaticFiles();
        app.UseExceptionHandler(AppSumExceptionMiddleware.JsonHandler());
        app.UseMvc();
    }

和我的中间件:

public class AppSumExceptionMiddleware
{
    public static Action<IApplicationBuilder> JsonHandler()
    {
        return errorApp =>
        {
            errorApp.Run(async context =>
            {
                var exception = context.Features.Get<IExceptionHandlerFeature>();
                if (exception != null)
                {
                    var exceptionJson = Encoding.UTF8.GetBytes(
                        JsonConvert.SerializeObject(new AppSumException(exception.Error), 
                        new JsonSerializerSettings
                        {
                            ContractResolver = new CamelCasePropertyNamesContractResolver()
                        })
                    );
                    context.Response.ContentType = "application/json";
                    await context.Response.Body.WriteAsync(exceptionJson, 0, exceptionJson.Length);
                }
            });
        };
    }
}

        app.UseExceptionHandler(errorApp =>
        {
            errorApp.Run(async context =>
            {
                context.Response.StatusCode = 500; // for example
                var error = context.Features.Get<IExceptionHandlerFeature>();
                if (error != null)
                {
                    var ex = error.Error;
                    // custom logic
                }
            });
        });