Difference between AuthorizeAttribute and IAuthenticationFilter

Question

In ASP.Net Web API 2 (Owin) what is the difference between IAuthenticationFilter and AuthorizeAttribute ?

Currently, I have performed my authorization by creating my own AuthorizeAttribute as follows:

 public class IntegratedAuthorization : AuthorizeAttribute { protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext) { bool returnValue = false; if (actionContext.Request.Headers.Authorization != null) { if (actionContext.Request.Headers.Authorization.Scheme != null) { if (actionContext.Request.Headers.Authorization.Scheme.ToLower() == "basic") { if (actionContext.Request.Headers.Authorization.Parameter != null) { // .... // .... // .... } } } } return returnValue; } } 

Than I added it to my HttpConfiguration as follows:

 config.Filters.Add(new IntegratedAuthorization()); 

Everything works fine, but when I searched on the Internet, I found many developers who use IAuthenticationFilter , as in this tutorial: Authentication Filters in ASP.NET Web API 2 .

Now the real question is, what is the difference between the two methods? What should i use?

Thanks!

Answer 1

AuthorizeAttribute is an implementation class for authorizing an application. You are following the right approach.

IAuthorizationFilter is a more generalized interface that is implemented by many filters, but they do not necessarily provide authorization. While MVC doesn’t care much about anyway, third-party libraries can only identify the authorization component in the application and thus connect to the security of the application, this is to check if it inherits AuthorizeAttribute bottom line is that if your component Authorization does not inherit AuthorizeAttribute , some third-party libraries may not work correctly in your application.

Since AuthorizeAttribute implements IAuthorizationFilter , you still have access to all its functions, including the OnAuthorization method that Farhad mentioned.

Microsoft's only drawback is that each application will be based on users and roles, creating these AuthorizeAttribute properties. So, if you have an application that is not there, you may need to hide these properties in your implementation.

 [Obsolete("Not applicable in this class.")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false), EditorBrowsable(EditorBrowsableState.Never)] new public string Roles { get; set; } [Obsolete("Not applicable in this class.")] [DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)] [Browsable(false), EditorBrowsable(EditorBrowsableState.Never)] new public string Users { get; set; } 

For third parties, an additional restriction is necessary - if you redefine OnAuthorization (note that you do not need it), it is important that a successful authorization actionContext.Response null for the actionContext.Response property and a failed authorization must set it to a non-zero value (a handler that will take action based on failure). This is how the default implementation works, and you have to follow one template if you need to configure it.