How do you create an Authorization Filter?

Authorization Filters act at the beginning of the request life cycle, before all other filters are executed. It determines if the request is authorized to access the resource or not.

To create an Authorization Filter, one can simply implement the IAuthorizationFilter interface and provide an implementation of the method:

interface IAuthorizationFilter {
  OnAuthorization(AuthorizationFilterContext ctx);
}

How do you create an Action Filter?

An ActionFilter can be created in two ways:

  1. Implement the IActionFilter interface
  2. Extend the ActionFilterAttribute abstract class

IActionFilter contains two methods, that the custom Action Filter needs to implement:

OnActionExecuting(ActionExecutingContext ctx) - before action is executed
OnActionExecuted(ActionExecutedContext ctx) - after action is executed

ActionFilterAttribute abtract class has the below methods which can be overriden as required:

OnActionExecuting(ActionExecutingContext ctx) - before action is executed
OnActionExecuted(ActionExecutedContext ctx) - after action is executed
OnResultExecuting(ResultExecutingContext ctx) - before the ActionResult instance is invoked
OnResultExecuted(ResultExecutedContext ctx) - after the ActionResult instance is invoked