c# - Combine custom AuthorizeAttribute and RequireHttpsAttribute -

i have custom requirehttpsattribute , custom authorizeattribute apply in filterconfig ensure controllers uses https , authorizes in same way.

i have controller action need other authorization. in case must first use [overrideauthorization] override global authorization filter, , can set special authorization action.

but [overrideauthorization] override customrequirehttpsattribute since inherts iauthorizationfilter. can don't have readd customrequirehttpsattribute attribute every time override authorization?

public class filterconfig {     public static void registerglobalfilters(globalfiltercollection filters)     {         filters.add(new customrequirehttpsattribute());         filters.add(new customauthorizeattribute(role = "user"));     } }  public class mycontroller : basecontroller {     public actionresult dosomeuserstuff()     {     }      [overrideauthorization]     [customrequirehttpsattribute]     [customauthorizeattribute(role = "admin")]     public actionresult dosomeadminstuff()     {     } } 

i ended creating own custom ifilterprovider based on modified version of this post.

i added attribute can use controllers or actions want override attribute set globally. nothing else extend customauthorizeattribute carries same functionality:

public class overridecustomauthorizeattribute : customauthorizeattribute {} 

then create ifilterprovider checks presence of overridecustomauthorizeattributes in list of filters. if so, remove customauthorizeattributes list:

public class customfilterprovider : ifilterprovider {     private readonly filterprovidercollection _filterproviders;      public customfilterprovider(ilist<ifilterprovider> filters)     {         _filterproviders = new filterprovidercollection(filters);     }      public ienumerable<filter> getfilters(controllercontext controllercontext, actiondescriptor actiondescriptor)     {         var filters = _filterproviders.getfilters(controllercontext, actiondescriptor).toarray();          var shouldoverridecustomauthorizeattribute = filters.any(filter => filter.instance overridecustomauthorizeattribute);         if (shouldoverridecustomauthorizeattribute)         {             // there overridecustomauthorizefilterattribute present, remove customauthorizeattributes list of filters             return filters.where(filter => filter.instance.gettype() != typeof(customauthorizeattribute));         }          return filters;     } } 

i register ifilterprovider in global.asax.cs:

public class mvcapplication : system.web.httpapplication {     protected void application_start()     {         // other stuff first....          var providers = filterproviders.providers.toarray();         filterproviders.providers.clear();         filterproviders.providers.add(new customfilterprovider(providers));     } } 

and register global customauthorizeattribute in filterconfig.cs before:

public class filterconfig {     public static void registerglobalfilters(globalfiltercollection filters)     {         filters.add(new customrequirehttpsattribute());         filters.add(new customauthorizeattribute(role = "user"));     } } 

the difference use overridecustomauthorizeattribute in controller instead:

public class mycontroller : basecontroller {     public actionresult dosomeuserstuff()     {     }      [overridecustomauthorizeattribute(role = "admin")]     public actionresult dosomeadminstuff()     {     } } 

this way, customrequirehttpsattribute set globally , never overridden.