Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

MessageHandlers vs Filters in asp.net mvc web api project

What's the difference between using a MessageHandler vs a Filter to check for an API key in the request header for an MVC web api project.

I see that there is a well outlined example of a MessageHandler for just that purpose in http://www.asp.net/web-api/overview/working-with-http/http-message-handlers

e.g.

GlobalConfiguration.Configuration.MessageHandlers.Add(new ApiKeyHandler());

But it looks like I can do the same thing using a filter as well.

GlobalConfiguration.Configuration.Filters.Add(new ApiKeyFilter());

Assuming ApiKeyFilter and ApiKeyHandler both just look at the request header and check for an api key, Which way is more efficient? What's the difference?

like image 309
MonkeyBonkey Avatar asked Feb 24 '13 13:02

MonkeyBonkey


1 Answers

MessageHandlers run much earlier than filters.

the order is:

-MessageHandler

-Authorization filter

-Model binding

-Other filters

Security related stuff should run as early as possible.

like image 92
leastprivilege Avatar answered Oct 19 '22 07:10

leastprivilege