title: Mediatr 3.0 Using Pipeline behaviors for authentication
body: <p>Looking at using the new Mediatr 3.0 feature pipeline behaviors for authentication/authorization.</p>
  
  <p>Would you normally auth based on the message or the handler? reason I'm asking is that I'd auth on the handler (same as controller in MVC) but behaviors don't appear to have knowledge about the handler so I'm not sure this is possible/suitable.</p>
  
  <p>I could add an IAuthorisationRequired marker interface to each message, but if the message is a notification/event and has multiple handlers then maybe some should run but not others.  Really does feel better checking auth on the handler code that does the actual work.</p>
  
  <p>Would love to be able to put a [Authorize] attribute on a handler and user a behaviour to check it (I currently do exactly this but with a base class instead of a behaviour).</p>
  
  <pre><code>public class AuthenticationBehavior&lt;TRequest, TResponse&gt; : IPipelineBehavior&lt;TRequest, TResponse&gt;
  {
      public Task&lt;TResponse&gt; Handle(TRequest request, RequestHandlerDelegate&lt;TResponse&gt; next)
      {
          //Can't access handler class here, so how do I know the action requires authentication/authorization?
          return next();
      }
  }
  
  [Authorize]
  public class ChangePasswordRequestHandler : IAsyncRequestHandler&lt;ChangePassword, ReponseType&gt;
  {   
      protected override async Task&lt;ReponseType&gt; Handle(AsyncRequestBase&lt;ChangePassword&gt; message)
      {
          //change users password here
      }
  }
  </code></pre>