Chapter 21: The MVC and Razor Pages filter pipeline

Introduction

Introduces the MVC and Razor Pages filter pipeline as an internal, middleware-like mechanism for cross-cutting concerns and previews how the chapter explores its types, use, and ordering.

• Filter pipeline purpose: Explain that the MVC and Razor Pages filter pipeline, also called the action invocation pipeline, is a sequence of components inside the MVC and Razor Pages frameworks for handling cross-cutting concerns. Describe authorization as a built-in filter use case that controls which users can access actions or pages.
  Why it matters: Filters provide a structured place to apply shared behavior around MVC actions and Razor Pages.
• Pipeline and middleware relationship: Describe the MVC filter pipeline as a mini middleware-like pipeline inside the MVC and Razor Pages frameworks: filters are connected in sequence, so one filter's output feeds the next filter's input. Distinguish it from the application middleware pipeline by its location within the MVC/Razor Pages framework.
  Why it matters: Knowing where filters operate helps you decide whether shared behavior belongs in MVC/Razor Pages filters or application-wide middleware.
• Chapter filter progression: Trace the chapter's progression from explaining MVC and Razor Pages filter pipelines and their filter types, through comparing filters with middleware, to creating, applying, and ordering filters. State that the next chapter develops practical built-in and custom filter examples.
  Why it matters: This roadmap helps you connect the basic pipeline model to filter application, execution order, and later custom-filter work.

Key terms: filter pipeline, action invocation pipeline, cross-cutting concerns, authorization filters, MVC filter pipeline, middleware pipeline, minimal API endpoint filter pipeline, filters, filter types, custom filter

21.1 Understanding the MVC filter pipeline

This section introduces the MVC filter pipeline as MVC-specific hooks for running shared code at defined points during a controller request.

• MVC filter pipeline purpose: Explain that the MVC filter pipeline provides hooks into normal MVC request handling for common cross-cutting code across all or selected MVC requests. Describe how filters reduce duplicated action-method code and can run logic such as authorization, validation handling, output customization, or exception handling.
  Why it matters: Filters let you apply request-wide behavior without repeating it in every controller action.
• MVC filter stages: Describe the five MVC filter types and their locations: authorization runs first; resource runs after authorization and can run again at the end; action runs immediately before and after an action method; exception handles pipeline exceptions; and result runs before and after an IActionResult executes. Relate a filter type to what it can access or control at that point.
  Why it matters: Picking the right filter type depends on when its code must run relative to model binding, action execution, and result execution.
• Short-circuiting filter requests: Explain that authorization filters can stop unauthorized requests before the rest of the pipeline or action runs, and that resource filters can return a response without continuing the pipeline. Describe that action filters can replace an action with a different IActionResult and result filters can stop result execution.
  Why it matters: Short-circuiting lets an application reject or answer a request without doing unnecessary later work.
• Filters versus endpoint filters: Distinguish the MVC filter pipeline from the minimal API endpoint filter pipeline: MVC has multiple filter types at different request stages, whereas the endpoint filter pipeline is linear and has no multiple filter categories. State that Razor Pages has an almost identical filter pipeline to MVC.
  Why it matters: The filter model you use and the hooks available depend on whether an endpoint uses MVC, Razor Pages, or minimal APIs.

Key terms: MVC filter pipeline, filters, cross-cutting concerns, action method, authorization filters, resource filters, action filters, exception filters, result filters, model binding

21.2 The Razor Pages filter pipeline

This section compares the Razor Pages filter pipeline with MVC and explains how page filters run at three distinct points around handler execution.

• Shared Razor Pages filters: Describe which filter stages Razor Pages shares with the MVC controller pipeline and how page filters replace action filters. State that authorization, resource, exception, and result filters are the same shared filter classes and behave the same way in both frameworks.
  Why it matters: This lets you transfer most MVC filter knowledge directly to Razor Pages while recognizing the one important pipeline difference.
• Three page filter execution points: Trace the three times a page filter executes: after page handler selection, after model binding and validation, and after page handler execution. Distinguish what is possible at each point, including when short-circuiting or changing the IActionResult is available.
  Why it matters: Knowing the three execution points tells you where a page filter can inspect request data, stop a handler, or alter its response.

Key terms: authorization filters, resource filters, exception filters, result filters, action filters, page filters, page handler selection, model binding, validation, IActionResult

21.3 Filters or middleware: Which should you choose?

This section compares MVC/Razor Pages filters with middleware and gives criteria for choosing the more appropriate scope and capabilities.

• Shared pipeline behaviors: Describe the ways middleware and MVC/Razor Pages filters behave similarly: they can surround request processing, short-circuit by returning a response, and address cross-cutting concerns.
  Why it matters: Recognizing the overlap helps you see filters as another pipeline-based way to run common request logic.
• Scope and MVC access: Distinguish middleware from filters by explaining that middleware can apply to all requests at its pipeline position and works independently of MVC, whereas filters run only for requests that reach EndpointMiddleware and execute a controller action or Razor Page handler. Explain that filters can access MVC-specific constructs such as ModelState and IActionResult and can target selected controllers, actions, or Razor Pages.
  Why it matters: These differences determine whether shared logic belongs broadly in middleware or specifically in the MVC or Razor Pages filter pipeline.
• Filter selection criteria: Justify choosing middleware for a general concern with wide reach, and choosing a filter when behavior must access MVC constructs or vary for particular controller actions or Razor Pages. State that the choice is flexible when either works, and middleware can even be used inside the MVC filter pipeline as a filter.
  Why it matters: Choosing the right level of specificity keeps application-wide infrastructure separate from MVC- or page-specific behavior.
• Middleware-as-filter option: State that a middleware component can be used inside the MVC filter pipeline, effectively acting as a filter, and identify localization of multi-language requests as the canonical use case mentioned.
  Why it matters: This option can let you reuse middleware-style request logic where MVC filter scoping is needed.

Key terms: middleware pipeline, filter pipeline, short-circuiting, cross-cutting concerns, resource filters, action filters, EndpointMiddleware, controller action, Razor Page handler, ModelState

21.4 Creating a simple filter

This section shows how to implement synchronous or asynchronous MVC and Razor Pages filters, using resource filters to illustrate their lifecycle and pipeline contexts.

• Filter interface selection: Describe how a filter is implemented for a particular pipeline stage by using that stage's synchronous or asynchronous filter interface. State that a filter can be a POCO but is typically implemented as an attribute, and that only one of the sync or async interfaces should be implemented.
  Why it matters: Choosing the correct interface determines when your filter runs and whether it can perform asynchronous work.
• Synchronous resource filter lifecycle: Trace the two methods of an IResourceFilter: OnResourceExecuting runs when the request reaches the resource-filter stage, and OnResourceExecuted runs after the remainder of the pipeline has run. Describe the kinds of pipeline information available through the context objects.
  Why it matters: The before-and-after lifecycle lets a resource filter inspect or affect processing around model binding, action execution, and result execution.
• Asynchronous pipeline continuation: Explain that an IAsyncResourceFilter has one asynchronous method that receives a ResourceExecutingContext and a delegate for the remaining pipeline. State that the filter calls and awaits that delegate to run the remainder of the pipeline and receive a ResourceExecutedContext, while the sync version is recommended unless async work is required.
  Why it matters: The continuation delegate is how an asynchronous filter surrounds and awaits the rest of the filter pipeline.

Key terms: IAuthorizationFilter, IAsyncAuthorizationFilter, IResourceFilter, IAsyncResourceFilter, IActionFilter, IAsyncActionFilter, OnResourceExecuting, OnResourceExecuted, ResourceExecutingContext, ResourceExecutedContext

21.5 Adding filters to your actions and Razor Pages

This section explains how filter scope controls which MVC actions and Razor Pages a filter affects, from a single action to the entire application.

• Filter scope levels: Describe the available filter scopes and how each scope changes the set of requests a filter runs for. Explain that a filter can target an MVC action, an MVC controller, a Razor Page, or the application globally.
  Why it matters: Choosing a filter's scope lets you protect or customize only the requests that need it, rather than affecting the whole application.
• Attribute filter application: Explain how to apply a filter attribute to an MVC action, an MVC controller, or a Razor Page PageModel. State that a controller attribute affects every action in that controller, while a PageModel attribute affects all handlers in that Razor Page.
  Why it matters: Attribute-based filters provide a direct way to add behavior to selected controllers, actions, and pages.
• Global filter registration: Describe how globally scoped filters are registered through MVC options while configuring MVC services, rather than by decorating individual classes. State that global filters affect both controllers and Razor Pages, and that a Razor Pages application uses AddMvcOptions() to configure them.
  Why it matters: Global registration is the appropriate choice when the same filter behavior must apply consistently across an entire application.

Key terms: scope, action method, controller, Razor Page, global filter, filter attribute, LogResourceFilter, controller scope, PageModel, page handler

21.6 Understanding the order of filter execution

This section introduces how the execution order of multiple MVC or Razor Pages filters in the same pipeline stage is determined by scope and can be customized.

• Filter ordering within stages: Describe that the five filter-pipeline stages run in their fixed order, while multiple filters of the same type within one stage also require an execution order.
  Why it matters: Knowing the distinction between stage order and order within a stage helps you predict which filter code runs first.
• Scope effects on filter order: Explain that filters within a stage can have different scopes based on how they were added, and that scope affects their execution order.
  Why it matters: Filter scope is part of determining the order in which filters surrounding an action or Razor Page execute.
• Ordering customization roadmap: State that the section first examines the default filter order and then shows how to customize that order for application-specific requirements.
  Why it matters: This roadmap clarifies that default scope-based behavior can be adjusted when an application needs a different ordering.

Key terms: filter pipeline, filter stage, resource filters, scope, filter execution order, action method pipeline, default order, customize the order

21.6.1 The default scope execution order

This subsection explains how filter scope determines the default before-and-after execution order for MVC actions and Razor Pages.

• MVC filter scope ordering: Describe the default execution order for resource, action, and result filters in MVC: their *Executing methods run from global scope to action scope, while their *Executed methods run in the reverse direction.
  Why it matters: Knowing the nesting order lets you predict which filter surrounds another filter's work.
• Razor Pages scope ordering: Describe the default Razor Pages ordering: global filters run their *Executing and PageHandlerSelected methods before page-scope filters, and *Executed methods run in reverse order.
  Why it matters: This order shows which Razor Pages filter can set up or clean up work around a page-level filter and its handler.
• IOrderedFilter ordering control: State that IOrderedFilter provides additional control over filter order when the default scope ordering is insufficient, such as when multiple action filters have the same scope.
  Why it matters: IOrderedFilter is the mechanism to reach for when scope alone cannot put same-scope filters in the needed order.

Key terms: resource filters, action filters, result filters, *Executing methods, *Executed methods, global scope, Razor Pages, global scope filters, Razor Page scope filters, PageHandlerSelected methods

21.6.2 Overriding the default order of filter execution with IOrderedFilter

This section explains how IOrderedFilter overrides scope-based filter ordering by assigning numeric Order values within each filter-pipeline stage.

• IOrderedFilter ordering: Explain how implementing IOrderedFilter lets a filter control its execution order by providing an Order property. Describe that filters in a pipeline stage run from the lowest Order value to the highest, with scope used only when Order values are tied.
  Why it matters: IOrderedFilter lets you make multiple cross-cutting filters run in the precise sequence your action or Razor Page requires.
• Default filter Order value: State that filters which do not implement IOrderedFilter are treated as having Order = 0, including the filters that ship with ASP.NET Core. Explain that a custom filter can therefore use a negative or positive Order value to run relative to built-in filters.
  Why it matters: Knowing the default value lets you position a custom filter before or after the framework's built-in filters.

Key terms: IOrderedFilter, Order, filter pipeline, scope, Order = 0, ASP.NET Core filters

21.7 Summary

This summary recaps how MVC and Razor Pages filters provide stage-specific hooks for cross-cutting concerns, including their execution patterns, scopes, and ordering.