c# - Securing WebAPI with [Authorize] attribute vs. User.Identiy.IsAuthenticated -

i have webapi controller requires users authenticated , i'm using ms identity 2.0 authentication. controller looks this:

[route("myroute")] [authorize] [httppost] public httpresponsemessage post([frombody] string value) {   if (user.identity.isauthenticated == true)   {      ....    }   else   {       return new httpresponsemessage(system.net.httpstatuscode.forbidden);   }  

if remove 1 of these options @ time, in both cases, when unauthorized user calls controller, returns forbidden response. what's difference between these 2 options , there 1 that's better other?

thanks.

with [authorize] attribute, authorization logic can overridden filters , located @ central location in code.

the

if (user.identity.isauthenticated == true) {    ....  } else {     return new httpresponsemessage(system.net.httpstatuscode.forbidden); } 

basically same default [authorize] functionality, you'll repeating on , over.

a technical detail though, authorization filters [authorize] higher in pipeline, forbidden there more efficient server.

see: http://www.dotnet-tricks.com/tutorial/mvc/lyhk270114-detailed-asp.net-mvc-pipeline.html