Difference between Authorize and Request.IsAuthenticated

Question

I am relatively new to ASP.NET MVC and I am encountering the following piece of code very often:

[Authorize]
public ActionResult Index()
{
  if (Request.IsAuthenticated)
  // ...
}

Is the if-statement really necessary? Can somebody please explain the differences between the two?

Answer 1

The if check should not be needed. The [Authorize] attribute does that, in fact it does more by checking role membership as well. Check out the implementation of AuthorizeAttribute on GitHub to see how it works under the covers.

Answer 2

Authorize can check role membership. The if is redundant in this case as well.

That isn't a common pattern for ASP.NET MVC, you should ask who wrote the code.

This will just make testing a bit harder.