Action Filters in ASP.NET Core: A Practical Guide

An action filter in ASP.NET Core is a component that executes code before or after a controller action.

It’s used to apply cross-cutting logic without repeating it across all methods: measuring times, validating conditions, adding logs, modifying responses, or stopping execution when something doesn’t meet the rules.

Think about those cases where you have twenty actions and you want to do the same thing before entering each method. Copy-pasting that if twenty times works… until it doesn’t, which is usually quite soon.

Where filters fit

Filters live within the MVC subsystem of ASP.NET Core. This means they execute after the routing middleware, when ASP.NET Core already knows which controller and which action it’s going to execute.

Don’t confuse them with middlewares:

The simplified flow would be something like this:

Request -> Middleware -> Routing -> Filter -> Action -> Filter -> Response

If we need to act on any request, even static files or non-existent routes, we usually want a middleware. If we need to know which action is about to be executed, then filters are a better fit.

Filter types

ASP.NET Core has several types of filters, depending on when they execute.

In this post we focus on action filters, which are the most commonly used when working with controllers.

Creating an action filter

The easiest way to start is by inheriting from ActionFilterAttribute. This way, we can apply the filter as an attribute on an action or controller.

using Microsoft.AspNetCore.Mvc.Filters;
using System.Diagnostics;

public class TimeLogFilterAttribute : ActionFilterAttribute
{
    public override async Task OnActionExecutionAsync(
        ActionExecutingContext context,
        ActionExecutionDelegate next)
    {
        var stopwatch = Stopwatch.StartNew();
        var actionName = context.ActionDescriptor.DisplayName;

        Console.WriteLine($"Starting execution of {actionName}");

        var resultContext = await next();

        stopwatch.Stop();
        Console.WriteLine($"Finished {actionName} in {stopwatch.ElapsedMilliseconds} ms");
    }
}

The important piece is await next(). This call continues the pipeline and allows the controller action to execute.

Applying the filter

We can apply a filter at three different levels.

[HttpGet]
[TimeLogFilter]
public IActionResult Get()
{
    return Ok("Hello world");
}

[ApiController]
[Route("api/[controller]")]
[TimeLogFilter]
public class UsersController : ControllerBase
{
    // Controller actions
}

builder.Services.AddControllers(options =>
{
    options.Filters.Add<TimeLogFilterAttribute>();
});

Filters with dependency injection

The previous example uses Console.WriteLine, which is fine for learning, but in a real application we would use ILogger.

Attributes in C# are not the best place to inject complex dependencies. For that, we can create a filter as a service and implement it with IAsyncActionFilter.

using Microsoft.AspNetCore.Mvc.Filters;

public class LogActionFilter : IAsyncActionFilter
{
    private readonly ILogger<LogActionFilter> _logger;

    public LogActionFilter(ILogger<LogActionFilter> logger)
    {
        _logger = logger;
    }

    public async Task OnActionExecutionAsync(
        ActionExecutingContext context,
        ActionExecutionDelegate next)
    {
        _logger.LogInformation("Starting action {Action}",
            context.ActionDescriptor.DisplayName);

        await next();

        _logger.LogInformation("Action finished");
    }
}

We register it in the container:

builder.Services.AddScoped<LogActionFilter>();

And we use it with [ServiceFilter]:

[HttpGet]
[ServiceFilter(typeof(LogActionFilter))]
public IActionResult Get()
{
    return Ok();
}

ASP.NET Core will resolve the filter from the DI container, complete with its dependencies.

Short-circuiting execution

A filter can also return a response without executing the action. To do this, we assign context.Result.

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;

public class ValidatePositiveIdAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext context)
    {
        if (!context.ActionArguments.TryGetValue("id", out var value))
        {
            return;
        }

        if (value is int id && id <= 0)
        {
            context.Result = new BadRequestObjectResult(
                "The id must be greater than zero");
        }
    }
}

If the id is negative or zero, the controller doesn’t get executed. The response is returned directly to the client.