ASP.NET Web API Authorization Filter

Question

I have a global authorization filter with overridden OnAuthorization method.

On debugging, I see that the controller class is instantiated first and then the OnAuthorization method is invoked.

Is this a known behavior as I have some code in the controller constructor which need not run if not authorized.

Is there any way to work around this?

what exactly is your constructor doing - are you sure it isn't doing too much? Generally speaking, your constructor shouldn't be dealing with authorisation concerns at all. — Stephen Byrne
– Stephen Byrne, Commented May 29, 2014 at 7:41

Guanxi · Accepted Answer · 2014-05-29 12:23:07Z

5

Action filter are executed just before the Action on which they are applied to. If you have global Authorization filter, that means they are registered globally and you don't have to decorate each action with those filters, but that does not change behavior of Action filters i.e. to execute just before the action.

Controllers are initialized first and then corresponding Actions are called, so your authorization filter will be executed after Constructor of Controller and just before the action. This is behaviour of Action filters as they are designed so.

If you want to execute authorization before controller construct, try creating Message handler for authorization instead of Action filter by inheriting DelegatingHandler class.

answered May 29, 2014 at 12:23

Guanxi

3,14124 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Web API Authorization Filter

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related