title: Should I be using an IAuthorizationFilter if I wish to create an ApiKey restricted resource with ASP.NET MVC4?
body: <p>I have a few simple routes which I wish to restrict via a simple querystring param. If the key is incorrect or not provided, then I wish to throw a <code>NotAuthorizedException</code>.</p>
  
  <p>Please don't suggest I use WebApi or the equiv - I can't just yet in this scenario.</p>
  
  <p>So i'm not sure if I should be implementing an <code>IAuthorizationFilter</code> or implementing an <code>IActionFilter</code> or even something else.</p>
  
  <p>My code logic?</p>
  
  <ul>
  <li>Check querystring for key.</li>
  <li>Check my RavenDb (repository) for a user with that key/value.</li>
  </ul>
  
  <p>If they fail any of those checks, then throw the <code>NotAuthorizedException</code>.</p>
  
  <p>I'm assuming I would then decorate a my action method with this filter. I'm also assuming i would need to pass in my repository into this action method also?</p>
  
  <p>Any suggestions please?</p>