What is the difference between Authorize Action filter and Authorization filter?

Question

As per the ASP.NET website

The ASP.NET MVC framework includes several action filters:

1. OutputCache – This action filter caches the output of a controller action for a specified amount of time.
2. HandleError – This action filter handles errors raised when a controller action executes.
3. Authorize – This action filter enables you to restrict access to a particular user or role.

Also, there is a type of filter in MVC called "Authorization filter".

I am confused whether [Authorize] attribute is an Action filter or Authorization filter? And when will it be executed ?

Answer 1

What is the difference between Authorize Action filter and Authorization filter?

None.

That documentation is apparently incorrect (and if you note in the table of contents, it is for version 1 and 2 of MVC, so it is also out of date).

AuthorizeAttribute inherits IAuthorizationFilter, so it is in fact an authorization filter, not an action filter. There is no Authorization action filter in MVC.

Note that for MVC 3 to MVC 5 you should refer to the up-to-date Filtering in ASP.NET MVC documentation in the future.

And when will it be executed ?

As per MSDN:

Filters run in the following order:

1. Authorization filters
2. Action filters
3. Response filters
4. Exception filters