What is the difference between authorizecore and onauthorization

Question

When will we create an attribute like AuthorizeAttribute We have these 2 properties to be overwritten

What is the difference between the two? Both seem to have the same function

[Edit]

The namespace of the cited attribute is System.Web.Mvc.Authorizeattribute

Answer 1

AuthorizeCore

It is the method that effectively makes the decision whether the user is authorized or not to access a given context. Here we check the roles, the normal rules, the special rules, and so on. The return is just a boolean.

OnAuthorization

It is a method that performs additional actions that have to do with the verification of the authorization itself, but it is not exactly the verification of the authorization. For example, to put conditions in place to verify whether the verification of the authorisation itself should be done or not.

Unlike AuthorizeCore, does not return output (void). The difference between the two is basically in the scope of each.

Answer 2

Succinctly:

• If you just want to reset the algorithm to determine whether a request is authorized or not, override the AuthorizeCore.
• Otherwise, use the OnAuthorization.

Basically, the OnAuthorization checks if a/the action/controller has the attribute AllowAnonymousAttribute. If you have the attribute, the tool is not required. If you do not have the attribute, then call the AuthorizeCore to determine whether the request is authorised.

After running the AuthorizeCore, the OnAuthorization defines how to respond to unauthorized requests.

PS: The source code of the two methods can be found in Github.