title: Need some help/advice with a custom ASP.NET MVC IAuthorizationFilter class
body: <p>i'm trying to make my own <code>IAuthorizationFilter</code> attribute class. Basically, each api call has a query string parameter called <em>'key'</em>. I was going to then decorate any actions that require this, with the simple authorisation attribute.</p>
  
  <p>I was hoping my <code>OnAuthorization(..)</code> method will then just extract the value of the query parameter, if it was provided. If it was, and it's legit, then the user is Authorised. otherwise, they are not.</p>
  
  <p>I'm not sure how to do this in the <code>OnAuthorization(..)</code> method.</p>
  
  <p>Or should I be using an <code>IActionFilter</code> instead?</p>
  
  <p>EDIT: I've added in some code to show what I'm doing...</p>
  
  <pre><code>public void OnAuthorization(AuthorizationContext filterContext)
  {
      if (filterContext == null)
      {
          throw new ArgumentNullException("filterContext");
      }
  
      ApiKey apiKey = null;
      string queryStringKey = filterContext.HttpContext.Request.QueryString["key"];
      if (!string.IsNullOrEmpty(queryStringKey))
      {
          apiKey = GetApiKey(queryStringKey); // Custom code that checks a dictionary.
      }
  
      // Do we have a key?
      if (apiKey == null)
      {
          filterContext.Result = new HttpUnauthorizedResult();
      }
  
      // TODO: Is this key allowed for this domain?
  
      // All is good, so don't do anything else.
  }
  </code></pre>