ASP.NET Core MVC 过滤器是单例吗？

Question

I have an AuthorizationFilter as follows:

public class AuthorizationFilterAttribute : Attribute, IAuthorizationFilter
{
    public AuthorizationFilterAttribute()
    {
        //Constructor of AuthorizationFilter will be called one time
    }

    public void OnAuthorization(AuthorizationFilterContext context)
    {
        //OnAuthorization method will be called per http request
    }
}

I found the constructor of AuthorizationFilter will just be called one time during the whole ASP.NET Core application lifetime. But its OnAuthorization method will be called per HTTP request.

Does it mean all filters (including IAuthorizationFilter , IActionFilter , IResourceFilter , IExceptionFilter etc) in ASP.NET Core MVC are singletons, which means they will be created just one time during ASP.NET Core application lifetime?

Answer 1

It depends on the IFilterFactory.IsReusable property that is associated with your filter.

When the IFilterProvider (which by default is DefaultFilterProvider ) is about to provide the desired instance, it first checks whether the filter implements IFilterFactory as well:

• If it does, it uses the filter's own IsReusable property to determine the lifetime of the instance.
• If not, it assumes the filter is reusable and IsReusable is set to true .

In the case of your custom AuthorizationFilterAttribute , since you don't implement IFilterProvider , it's indeed considered as reusable and will be created only once.

See Source

Answer 2

Thanks for haim770's answer.

I found an implementation that can create a filter instance per http request rather than ASP.NET Core application lifetime.

Actually, we need to create the filter internally and wrap it into an IFilterFactory like below:

using Microsoft.AspNetCore.Mvc.Filters;
using System;

namespace AspNetCoreFilterDemo.Filters
{
    public class AuthorizationFilterWithFactoryAttribute : Attribute, IFilterFactory
    {
        //Return false, IFilterFactory.CreateInstance method will be called per http request
        //Return true, InternalAuthorizationFilter will still be singleton, since IFilterFactory.CreateInstance will be called only one time during the whole ASP.NET Core application lifetime
        public bool IsReusable
        {
            get
            {
                return false;
            }
        }

        private class InternalAuthorizationFilter : IAuthorizationFilter
        {
            public InternalAuthorizationFilter()
            {
                //This InternalAuthorizationFilter constructor will be called per http request rather than ASP.NET Core application lifetime
            }

            public void OnAuthorization(AuthorizationFilterContext context)
            {
                //OnAuthorization method will be called per http request
            }
        }

        public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
        {
            //Create InternalAuthorizationFilter instance per http request
            return new InternalAuthorizationFilter();
        }
    }
}

Please be aware of IFilterFactory.IsReusable property, we need to return false, otherwise the IFilterFactory.CreateInstance method will be called only one time during ASP.NET Core application lifetime, and InternalAuthorizationFilter is still singleton.

Then, we need to specify the AuthorizationFilterWithFactoryAttribute on controller instead of InternalAuthorizationFilter , but AuthorizationFilterWithFactoryAttribute will actually create and operate on an InternalAuthorizationFilter instance per http request:

using Microsoft.AspNetCore.Mvc;
using AspNetCoreFilterDemo.Filters;

namespace AspNetCoreFilterDemo.Controllers
{
    public class HomeController : Controller
    {
        public HomeController()
        {

        }

        [AuthorizationFilterWithFactory]
        public IActionResult Index()
        {
            return View();
        }
    }
}

AuthorizationFilterWithFactoryAttribute will still be singleton and created one time, but we approached the target to create the filter ( InternalAuthorizationFilter ) per http request.

You can also take a reference from MSDN .