What are the five filter types in ASP.NET Core MVC and their order?
Quick Answer
In execution order: Authorization (can short-circuit early), Resource (around model binding), Action (before/after the action method), Exception (handles unhandled exceptions from the action), Result (around result execution). Any filter can short-circuit by setting context.Result.
There are five. Authorization filters run first — that's [Authorize] — and if authorization fails, nothing else runs. Resource filters wrap model binding, so they're a good place for caching or bailing out early. Action filters run right before and after the action method and can see and change the bound arguments and the result. Exception filters catch unhandled exceptions from the action. And result filters run around the response being written. Custom logic is usually an action filter, and any of them can short-circuit by setting the result.
- Authorization — first; used by
[Authorize]. Failing here skips everything. - Resource — wraps model binding; good for caching or early exit before binding cost.
- Action — inspect/modify arguments and the returned result; most common for custom logic.
- Exception — turn an exception into a response.
- Result — modify the response, add headers, wrap serialization.
- Scopes: global → controller → action; ordering within a scope via
Order/IOrderedFilter.