A filter puts reusable request-processing logic around a particular ASP.NET Core endpoint, such as a controller action or Razor Page. It solves a problem middleware handles awkwardly: applying a policy to selected endpoints without making middleware understand routing or copying checks into every action. section 30.0 section 30.2
Require HTTPS without duplicating the check
Apply [RequireHttps] to an action to replace an in-method Request.IsHttps check. Put it on the controller when all its actions need the policy. The actions can then concentrate on producing their results rather than repeating a security check. section 30.2
Choose the filter type for the point at which the logic must run:
- Authorization filters enforce authorization policy and can stop an unauthenticated request. section 30.3
- Resource filters intercept requests before model binding; caching is a typical use. section 30.3 section 30.8
- Action filters surround controller actions; page filters surround Razor Page handling. Both can inspect or change processing after model binding. section 30.3 section 30.8
- Result filters work around result execution, while exception filters handle exceptions that are thrown. section 30.8
Filters run in their own ordered pipeline. Some can inspect processing before and after an endpoint runs, change a request or response, or short-circuit later processing. Implement the appropriate synchronous or asynchronous filter interface to create one; IOrderedFilter changes application order. section 30.3 section 30.0
Table 30.3 The filter types, interfaces, and attribute base classes (view table figure)
| Filter Type |
Interfaces |
Attribute Class |
|---|---|---|
| Authorization filters |
IAuthorizationFilter IAsyncAuthorizationFilter |
No attribute class is provided. |
| Resource filters |
IResourceFilter IAsyncResourceFilter |
No attribute class is provided. |
| Action filters |
IActionFilter IAsyncActionFilter |
ActionFilterAttribute |
| Page filters |
IPageFilter IAsyncPageFilter |
No attribute class is provided. |
| Result filters |
IResultFilter IAsyncResultFilter IAlwaysRunResultFilter IAsyncAlwaysRunResultFilter |
ResultFilterAttribute |
| Exception Filters |
IExceptionFilter IAsyncExceptionFilter |
ExceptionFilterAttribute |
Use the interface table to find the implementation contract for each filter type and the types with an attribute base class. section 30.3
Constrain an API response format
On an API action, [Produces("application/json")] limits the formats considered when processing an Accept header. Alternatively, [FormatFilter] with a {format?} route segment lets /api/content/object/json or /api/content/object/xml select a format despite that header. section 20.4.3 section 20.4.4
Mind the object lifecycle if a filter holds state. Filter objects are reused by default. Registering one as a scoped service gives it a per-request lifetime; [ServiceFilter(typeof(GuidResponseAttribute))] applies a service-backed filter without requiring that filter to derive from Attribute. section 30.5 section 30.5.2
