title: Why is onAuthorization executing before authentication?
body: <p>I'm trying to do some custom authorization so I created a controller overriding the <code>OnAuthorization</code> method. I also applied the <code>Authorize</code> attribute to this controller.
  The question is why is the <code>OnAuthorization</code> method called BEFORE the basic forms authentication process?</p>
  
  <p>I would like to authorize the user after he is authenticated.
  Am I missing something?</p>
  
  <p>Here is the code:</p>
  
  <pre><code>[Authorize]
      public class AuthorizationController : Controller
      {
          protected override void OnAuthorization(AuthorizationContext filterContext)
          {
              base.OnAuthorization(filterContext);
  
              if (filterContext == null)
              {
                  throw new ArgumentNullException("filterContext");
              }
  
              List&lt;string&gt; allowedControllers = new List&lt;string&gt;() { "SecurityController" };
              List&lt;string&gt; allowedActions = new List&lt;string&gt;() { "Index" };
  
              string controllerName = filterContext.Controller.GetType().Name;
              string actionName = filterContext.ActionDescriptor.ActionName;
  
              if (!allowedControllers.Contains(controllerName)
              || !allowedActions.Contains(actionName))
              {
                  filterContext.Result = View("UnauthorizedAccess");
              }
          }
      }
  </code></pre>
  
  <p>The controller that I tested with is something like:</p>
  
  <pre><code>public class SecurityController : AuthorizationController
  {
  
      public ActionResult Index()
      {
          return View();
      }
  
      public ActionResult AnotherIndex()
      {
          return View();
      }
  }
  </code></pre>