What's the purpose of IAuthenticationFilter.OnAuthenticationChallenge()

Question

I have a custom IAuthenticationFilter implementation registered in RegisterGlobalFilters(). In my project I'm witnessing the following call sequence:

1. IAuthenticationFilter.OnAuthentication
2. authorization (if any)
3. controller action
4. IAuthenticationFilter.OnAuthenticationChallenge

Why does it happen after controller action? From this blog post I read

The key thing to remember is that OnAuthenticationChallenge does not necessarily run before every other Action Filter. It can run at various stages.

How can it be useful if we can't tell when exactly it is called?

Answer 1

Source

"The OnAuthenticationChallange method is called by the MVC Framework whenever a request has failed the authentication or authorization policies for an action method. The OnAuthenticationChallenge method is passed an AuthenticationChallengeContext object, which is derived from the ControllerContext class"

So, a practical example would be:

1 - You set your custom authorize filter

2 - users fails on authorizing method

3 - OnAuthenticationChallenge method is called.