using Microsoft.AspNetCore.Mvc;

namespace demo1.Filter.Attribute
{
  
    public class PermissionAttribute : TypeFilterAttribute
    {
        public PermissionAttribute(string permission) : base(typeof(PermissionFilter))
        {
            Arguments = new object[] { permission };
        }
    }
}


using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;

namespace demo1.Filter
{
    public class PermissionFilter : IAsyncAuthorizationFilter
    {
        private readonly string _permission;
        public PermissionFilter(string permission)
        {
            _permission = permission;
        }
        public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
        {
            // 1. 获取当前用户
            var user = context.HttpContext.User;

            //context.Result = new Microsoft.AspNetCore.Mvc.ForbidResult( );

            context.Result = new ObjectResult(new { error = $"Missing permission: {_permission}" })
            {
                StatusCode = StatusCodes.Status403Forbidden
            };
            // 2. 判断用户是否具有特定权限（例如 "Admin" 角色）
            //if (!user.IsInRole("Admin"))
            //{
            //    // 3. 如果没有权限，返回 403 Forbidden
            //    context.Result = new Microsoft.AspNetCore.Mvc.ForbidResult();
            //    return;
            //}
            // 如果有权限，不做任何操作，继续执行
        }
    }
}

实例：

        [Permission("方法的过滤器")]
        [HttpGet]
        public async Task<IActionResult> Showtoken()
        {
            long userid = User.GetUserId();
            if (userid == 0) 
            {
                return Unauthorized("无法获取用户信息");
            }
            Users users =await  DbContext.Set<Users>().FindAsync(userid);
            if(users == null)
            {
                return NotFound("未找到");
            }
            return Ok(users);
        }