Order of execution with multiple filters in web api

Question

I am using latest web api.

I do annotate some controllers with 3 different filter attributes.

1 [Authorize] 2 [RessourceOwnerAttribute derived from AuthorizationFilterAttribute] 3 [InvalidModelStateAttribute derived from ActionFilterAttribute] 

I can not be sure that the filters run in the order they are declared from top to down.

How do I define the order of execution in web api 2.1 ?

https://aspnetwebstack.codeplex.com/workitem/1065#

http://aspnet.uservoice.com/forums/147201-asp-net-web-api/suggestions/3346720-execution-order-of-mvc4-webapi-action-filters

Do I still have to fix that for myself ??

Answer 1

Some things to note here:

1. Filters get executed in the following order for an action: Globally Defined Filters -> Controller-specific Filters -> Action-specific Filters.
2. Authorization Filters -> Action Filters -> Exception Filters

3. Now the problem that you seem to mention is related to having multiple filters of the same kind (ex: Multiple ActionFilterAttribute decorated on a controller or an action. This is the case which would not guarantee the order as its based on reflection.). For this case, there is a way to do it in Web API using custom implementation of System.Web.Http.Filters.IFilterProvider. I have tried the following and did some testing to verify it. It seems to work fine. You can give it a try and see if it works as you expected.

   // Start clean by replacing with filter provider for global configuration. // For these globally added filters we need not do any ordering as filters are  // executed in the order they are added to the filter collection config.Services.Replace(typeof(IFilterProvider), new System.Web.Http.Filters.ConfigurationFilterProvider());  // Custom action filter provider which does ordering config.Services.Add(typeof(IFilterProvider), new OrderedFilterProvider()); 

   ---

   public class OrderedFilterProvider : IFilterProvider {     public IEnumerable<FilterInfo> GetFilters(HttpConfiguration configuration, HttpActionDescriptor actionDescriptor)     {         // controller-specific         IEnumerable<FilterInfo> controllerSpecificFilters = OrderFilters(actionDescriptor.ControllerDescriptor.GetFilters(), FilterScope.Controller);          // action-specific         IEnumerable<FilterInfo> actionSpecificFilters = OrderFilters(actionDescriptor.GetFilters(), FilterScope.Action);          return controllerSpecificFilters.Concat(actionSpecificFilters);     }      private IEnumerable<FilterInfo> OrderFilters(IEnumerable<IFilter> filters, FilterScope scope)     {         return filters.OfType<IOrderedFilter>()                         .OrderBy(filter => filter.Order)                         .Select(instance => new FilterInfo(instance, scope));     } } 

   ---

   //NOTE: Here I am creating base attributes which you would need to inherit from. public interface IOrderedFilter : IFilter {     int Order { get; set; } }  public class ActionFilterWithOrderAttribute : ActionFilterAttribute, IOrderedFilter {     public int Order { get; set; } }  public class AuthorizationFilterWithOrderAttribute : AuthorizationFilterAttribute, IOrderedFilter {     public int Order { get; set; } }  public class ExceptionFilterWithOrderAttribute : ExceptionFilterAttribute, IOrderedFilter {     public int Order { get; set; } }