If you look at the method System.Web.Mvc.ControllerActionInvoker.InvokeActionwith a reflector, you will see that all filters that implement the IAuthorizationFilter are called before the attributes originating from the ActionFilterAttribute and that, since authorization is performed before the action is called.
source
share