System.Web.Http.Authorize versus System.Web.Mvc.Authorize

Question

Which Authorize Attribute ?
System.Web.Http.Authorize
System.Web.Mvc.Authorize

using System.Web.Mvc      // or
using System.Web.Http         


        

Answer 1

You must use System.Web.Http.Authorize against an ApiController (Web API controller) and System.Web.Mvc.Authorize against a Controller (MVC controller). Since the framework runs the filters as part of the pipeline processing and the controllers expect the right filter to be applied, if you don't use the corresponding filter, authorization will not work.