Understanding Filters in MVC

namespace WebSecurityDemoTest.Filters
{
    public class WebSecurityAuthorize : AuthorizeAttribute
    {
        protected bool AuthorizeCore(HttpContextBase httpContext)
        {
            if (!httpContext.Request.IsAuthenticated)
            {
                return false;
            }
            if (HttpContext.Current.Session["SessionHelper"] == null)
            {
                return false;
            }
    
            return true;
        }
        protected void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            filterContext.Result = new RedirectResult("/");
            base.HandleUnauthorizedRequest(filterContext);
        }
    }
}

namespace WebDemo.Controllers
{
    public class DemoController : Controller
    {
        //..instances or constructor if any read only variables used
        public ActionResult Index()
        {
            if (!Request.IsAuthenticated)
            {
                FormsAuthenticationn.RedirectToLoginPage(); //MVC WebSecurity
            }
            //else rest implementation..
        }
    }
}

namespace System.Web.MVC
{
    public interface IAuthorizationFilter
    {
        void OnAuthorization(AuthorizationContext filterCOntext);
    }
}

namespace System.Web.MVC
{
    public interface IActionFilter
    {
        void OnActionExecuting(ActionExecutingContext filterContext);
        void OnActionExecuted(ActionExecutedContext filterContext);
    }
}

Name	Description
ActionDescriptor	This provides the details of an action method
Result	This gives the result for the action method, the filter can be manipulated to cancel the request also

Let's look into the implementation of this method, in a custom action filter attribute.

namespace Filters.WebDemoInfra
{
    public class CustomActionFilter : FilterAttribute, IActionFilter
    {
        public void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (filterContext.HttpContext.Request.IsLocal)
            {
                filterContext.Result = new HttpNotFoundResult();
            }
        }
    }
}

Thus when we try and understand what we have written in the snippet above, we find that, before the action is executed, this method is invoked, and the method OnActionExecuting returns a not null result. In other words, HttpNotFoundResult will land the user on a 404 not found error page, even if the action has a view defined. This is the power of this filter. Now let's look into its sister's implementation.

OnActionExecuted

This method as defined previously, can be invoked to span the execution of the action method being processed based on the request. Let's check using an example that will measure the time taken for the action to complete the full execution.

namespace Filters.WebDemoInfra
{
    public class CustomActionFilter : FilterAttribute, IActionFilter
    {
        private Stopwatch timer; // System.Diagnostics

        public void OnActionExecuting(ActionExecutingContext filterContext)
        {
            timer = Stopwatch.StartNew();
        }

        public void OnActionExecuted(ActionExecutedContext filterContext)
        {
            timer.Stop();
            if (filterContext.Exception == null)
            {
                filterContext.HttpContext.Response.Write(string.Format("Total Time taken: {0}", timer.Elapsed.TotalSeconds));
            }
        }
    }
}

The preceding snippet is a very simple snippet to understand. The private variable is of type StopWatch which is a built-in class in the namespace System. Diagnostics. In the executing method, we are initializing the timer and after execution of the action method since the executed method is invoked, the httpContext that contains both the request and response as well, we assign the time elapsed in seconds to the response. Let's look at the properties provided by the OnActionExecuted method.

Name	Description
ActionDescriptor	This provides the details of an action method
Cancelled	If in case the action has been canceled by any other filter this property returns true
Exception	If any filter or any action throws an exception, it is returned by this property
ExceptionHandled	If any filter or any action throws an exception and it has been handled, this property returns true
Result	This gives the result for the action method, the filter can be manipulated to cancel the request also

Thus, this was all about the Action filters. Result Filter These are quite similar to the Action Filters. These are the filters that are invoked or operate on the results being produced by the Action Result methods. This is implemented from the IResultFiler interface which also looks quite similar to the IActionFilter. Let's see how.

namespace System.Web.MVC
{
    public interface IResultFilter
    {
        void OnResultExecuting(ResultExecutingContext filterContext);
        void OnResultExecuted(ResultExecutedContext filterContext);
    }
}

OnResultExecuting

The OnResultExecuting method is invoked when a result has been returned by the Action method but before the action is executed fully. This also has the same properties as the OnActionExecuting method as described in the table.

OnResultExecuted

The OnResultExecuted method is invoked after the action result has been executed. Here also the parameter filterContext contains the same properties as the OnActionExecuted method as described in the table above. The demonstration can be the same Timer as described in the Action filter section. The following snippet will show you the built-in Action and Result Filter classes.

public abstract class ActionFilterAttribute : FilterAttribute, IActionFilter, IResultFilter
{
    public virtual void OnActionExecuting(ActionExecutingContext filterContext)
    {
    }
    public virtual void OnActionExecuted(ActionExecutedContext filterContext)
    {
    }
    public virtual void OnResultExecuting(ResultExecutingContext filterContext)
    {
    }
    public virtual void OnResultExecuted(ActionExecutedContext filterContext)
    {
    }
}

Using Global Filters

This is a very nice feature that can be implemented in the MVC application. Global.asax as we all know is the heart of the MVC web application. The Application_Start method is called from here whenever the application starts. We have a FilterConfig.cs file inside our App_start folder, where we can find a static method called RegisterGlobalFilters. In this method, we register our custom filter that needs to be invoked throughout the application that is applied to all controllers and actions in the application. Let's see how we register.

namespace Filters
{
    public class FilterConfig
    {
        public static void RegisterGlobalFilters(GlobalFilterCollection filters)
        {
            filters.Add(new HandleErrorAttribute());
            filters.Add(new CustomAllAttribute());
        }
    }
}

Thus the second filter added/registered as the global filter is our custom attribute. This custom attribute implementation needs to be thought upon and then written since this would be used throughout the application, so this should also be very simple so that it can be manipulated and maintained at any point in time.

Filter Ordering

In the MVC framework, the order in which the filter is invoked (if there is more than one action), does not matter much. But even if you wish to add order based on the business logic we have, then we can use the Order keyword that accepts an int value to set the order of the Filter invocation/execution. Let's use an example and understand.

[ProfileA(Message = "First")]
[ProfileB(Message = "Second")]
public ActionResult Index()
{
    //Implementation
}

In the preceding snippet, we have the two custom filters ProfileA and ProfileB that take a message as a parameter and print that using the context response write method. Thus, this would write "First" (For OnActionExecuting) "Second" (For OnActionExecuting) "Second" (For OnActionExecuted) "First" (For OnActionExecuted). Thus if we wish to modify the order like the "Second" would come first then the "First", then we need to use Order.

[ProfileA(Message = "First"), Order = 2]
[ProfileB(Message = "Second"), Order = 1]
public ActionResult Index()
{
    //Implementation
}

Thus, here the output as in the previous will change based on the order specified in the preceding snippet. Thus based on the requirements we can specify as many filters, it be built-in or custom, and set the order of execution also. This is how flexible the MVC framework is. :)

Conclusion

Thus here I tried to explain the filters that are being used in the MVC framework. Here I have discussed Authorize, Action & Result filters. I will try and explain the Exception Filters in the next section. Thanks for your patience. Corrections and suggestions are humbly accepted. :)

References

• Adam Freeman: Pro ASP.NET MVC