63

In MVC we can decorate action methods with different filters like

[HttpPost]
[Authorize]
public ActionResult mymethod(){}

HttpPost derives from MethodSelectorAttribute (probably indirectly) and the Authorize attribute inherits from ActionFilterAttribute.

My question is: in which order are they executed in the MVC request pipeline? I tried to go search in MVC source code but failed to find the relevant code bits.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Muhammad Adeel Zahid
  • 17,474
  • 14
  • 90
  • 155
  • I would assume the order in which they are returned during reflection which could possibly be influenced by the actual order in source. – Muhammad Hasan Khan Jul 03 '11 at 08:38
  • @Hasan bhai first of all nice to see you then i believe that HttpPost is actionmethodSelector (its method isValidForRequest is called) attribute and Authorize is actionFilter attribute (its onActionExecuting or onActionExecuted is called) so they have to be called at different times. probably HttpPost should be called before Authorize because they are different filters and have different responsibilities. – Muhammad Adeel Zahid Jul 03 '11 at 08:53
  • It appears my assumption was wrong. The answer by Eranga shows that Filters have a mechanism to specify their order. However since HttpPost is not a filter as it appears. It may have special handling perhaps by executing it before anything else. Again its an assumption. – Muhammad Hasan Khan Jul 03 '11 at 09:19

2 Answers2

84

Filters run in the following order:

  1. Authorization filters
  2. Action filters
  3. Response filters
  4. Exception filters

For example, authorization filters run first and exception filters run last. Within each filter type, the Order value specifies the run order. Within each filter type and order, the Scope enumeration value specifies the order for filters. This enumeration defines the following filter scope values (in the order in which they run):

  1. First
  2. Global
  3. Controller
  4. Action
  5. Last

Extracted from MSDN

Eranga
  • 32,181
  • 5
  • 97
  • 96
  • 1
    HttpPost is not any of above mentioned filter it is MehodSelectorAttribute – Muhammad Adeel Zahid Jul 03 '11 at 09:12
  • 2
    Yes it is used to choose the action method if there are multiple candidates. So it a marker attribute. Its used before the filters are executed – Eranga Jul 03 '11 at 09:51
  • 2
    please visit http://zahidadeel.blogspot.com/2011/07/ajaxonly-attribute-actionfilter-vs.html for further detail – Muhammad Adeel Zahid Jul 03 '11 at 13:43
  • 1
    model binder runs exactly when ? – Bart Calixto Aug 16 '14 at 21:18
  • It’s worth noting - A controller action filter is run after an action authorization filter. - A controller filter would take precedence over an action filter of the same type - By default order=-1 (lowest order, highest precedence) so that if you order=0 on a single filter, other filters having default of -1 would run first. - -1 is the lowest you can order, which actually just puts your filters on the same level as unordered, and so equal filters will run in an undetermined order… - Exception filters run in reverse order [Another Post](http://stackoverflow.com/a/30704435/2204129) – Nathan Zaetta Feb 22 '17 at 00:39
  • It also depends on the order they're declared. Eg if you have [ProfileResult1] [ProfileResult] decorating an action method, whatever is closest to the action method ([ProfileResult]) will have the OnResultExecuting() run first, but will have OnResultExecuted() run last, with ProfileResult1.OnResultExecuting() run 2nd and ProfileResult1.OnResultExecuted() run 3rd. – David Klempfner Jul 28 '18 at 07:45
26

To save you some time, this is how you set the order:

[MyCustomContextFilter(Order=1)]

The index is 0 based, so you can do 0, 1, 2, etc...

It should be noted that just because a filter is on the base class doesn't tell MVC to apply it first :(.

ProVega
  • 5,864
  • 2
  • 36
  • 34