In my MVC 5 application, I decorate my controllers as follows:

```
[Authorize]
public class Controller
{
  ..

```

However, one requirement I have is to use a token to authorize an action without going to the login screen. ie: `http://{website}/Action?token={/* token for this user */}`

Thus, **how can I develop a custom AuthorizeAttribute that accepts a login (default behavior) OR a token (custom, required behavior)?**

In other words, if I use `http://{website}/Action`, I would be redirected to the login screen (if I am not authorized), but if I use `http://{website}/Action?token={/* token for this user */}`, I would be authorized and redirected to said action.

---

`[TokenAuthorize]` class

```
public class TokenAuthorize : AuthorizeAttribute
{
    private const string SecureToken = "token";

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        if (Authorize(filterContext))
        {
            return;
        }

        HandleUnauthorizedRequest(filterContext);
    }

    private bool Authorize(AuthorizationContext actionContext)
    {
        try
        {
            HttpRequestBase request = actionContext.RequestContext.HttpContext.Request;
            string token = request.Params[SecureToken];

            return SecurityManager.IsTokenValid(token);
        }
        catch (Exception)
        {
            return false;
        }
    }
}

```

---

If I decorate my controllers with:

```
[Authorize]
[TokenAuthorize]
public class Controller
{
  ..

```

It is processed as `Authorize` AND `TokenAuthorize`[(1)](https://stackoverflow.com/a/17272479). I need to develop a way to process such as `Authorize` OR `TokenAuthorize`