asp.net - .NET Mvc and Web Api Filter Authorization, How and Where? -

i have been reading , searching best practice doing this.

i "learning" web asp .net mvc , web api 2.2.

i in point of authentication , authorization, understand meanning , difference in 1 , another. problem come authorization, know allow/deny access using filter , use roles.

but beside dont know implement logic authorize user action, or see data, example:

a user authenticated , have role pilot

this user enter controller/action example flight/getpassengers/1

where getpassengers action retreive passengers flight #1

let's imagine current logged user on role pilot wants view list of flight because allowed to, can't see passengers of flights, example flight/passengers/3 flight #3 user pilot.

where best place put validation logic?

inside action: getpassengers? don't think so, because if later in controller (flight) need validate if same info belongs current user (pilot) have repeat piece of code (dry)

so, maybe custom filter?

i find article (here) not sure if in there , how gets implementated. have implementation, this:

public class customfilter inherits actionfilterattribute implements iactionfilter  public overrides sub onactionexecuting(filtercontext actionexecutingcontext)     mybase.onactionexecuting(filtercontext) end sub  public overrides sub onactionexecuted(filtercontext actionexecutedcontext)     mybase.onactionexecuted(filtercontext) end sub  end class 

is creating type of filters , after using on controllers/actions correct way achieve this?

or how type of logic handled?

thanks suggestions

you should implement custom authorizeattribute can encapsulate logic. careful in way implement them, try not have several authorize filters. impact perfomance of application. design 1 can used widely.