Use Cases

In our sample application, we used all kinds of filters to make our application more compact and properly functional. Especially in cases where the same logic needs to be run multiple times, filters have their place. For example, let’s assume that we need to write a trace information every time a controller action runs. Listing 11-2 shows a controller implementation without filters.

Listing 11-2.  CarsController Without Filters

public class CarsController : ApiController {

    private readonly CarsContext _carsContext = new CarsContext();

    public IEnumerable<Car> GetCars() {

        log("GetCars");

        return _carsContext.All;
    }

    public Car GetCar(int id) {

        log("GetCar");

        return _carsContext.GetSingle(car => car.Id == id);
    }

    private void log(string actionName) {
         
        Trace.TraceInformation(
            string.Format(
                "Controller {0}, Action {1} is running...", "Cars", actionName
            )
        );
    }
}

CarsContext class here provides the data needed for our sample (Listing 11-3)

Listing 11-3.  Car and CarsContext Classes

public class Car {

    public int Id { get; set; }
    public string Make { get; set; }
    public string Model { get; set; }
    public int Year { get; set; }
    public float Price { get; set; }
}

public class CarsContext {

    private static int _nextId = 9;
    private static object _incLock = new object();

    // data store
    readonly static ConcurrentDictionary<int, Car> _carsDictionary = 
        new ConcurrentDictionary<int, Car>(
        new HashSet<KeyValuePair<int, Car>> {
            new KeyValuePair<int, Car>(
                1,
                new Car {
                    Id = 1,
                    Make = "Make1",
                    Model = "Model1",
                    Year = 2010,
                    Price = 10732.2F
                }
            ),
            new KeyValuePair<int, Car>(
                  2,
                   new Car {
                      Id = 2,
                      Make = "Make2",
                      Model = "Model2",
                      Year = 2008,
                      Price = 27233.1F
                  }
            ),

            //Lines omitted for brevity . . .
    });

    public IEnumerable<Car> All {
        get {
            return _carsDictionary.Values;
        }

    }

    public IEnumerable<Car> Get(Func<Car, bool> predicate) {

        return _carsDictionary.Values.Where(predicate);
    }

    public Tuple<bool, Car> GetSingle(int id) {

        Car car;
        var doesExist = _carsDictionary.TryGetValue(id, out car);
        return new Tuple<bool, Car>(doesExist, car);
    }

    public Car GetSingle(Func<Car, bool> predicate) {

        return _carsDictionary.Values.FirstOrDefault(predicate);
    }

    public Car Add(Car car) {

        lock (_incLock) {

            car.Id = _nextId;
            _carsDictionary.TryAdd(car.Id, car);
            _nextId++;
        }

        return car;

    }

    public bool TryRemove(int id) {

        Car removedCar;
        return _carsDictionary.TryRemove(id, out removedCar);
    }

    public bool TryUpdate(Car car) {

        Car oldCar;
        if (_carsDictionary.TryGetValue(car.Id, out oldCar)) {

            return _carsDictionary.TryUpdate(car.Id, car, oldCar);
        }

        return false;
    }
}

Notice that we are running the same code for logging functionality inside every controller action by passing a relevant parameter to the private log method. Imagine that this needs to be done inside every single action of all application controllers. However, the same result can be achieved by using filters without repeating ourselves. Listing 11-4 shows a sample action filter implementation that generates the same logic.

Listing 11-4.  CarsController with Filters

using System;
using System.Web.Http.Filters;
using System.Threading.Tasks;
using System.Net.Http;
using System.Web.Http.Controllers;
using System.Threading;
using System.Diagnostics;

namespace Overview.Filters {

    [AttributeUsage(
        AttributeTargets.Class | AttributeTargets.Method)]
    public class LoggerAttribute : Attribute, IActionFilter {

        public Task<HttpResponseMessage> ExecuteActionFilterAsync(
            HttpActionContext actionContext,
            CancellationToken cancellationToken,
            Func<Task<HttpResponseMessage>> continuation) {

            var controllerCtx = actionContext.ControllerContext;

            Trace.TraceInformation(
                "Controller {0}, Action {1} is running...",
                controllerCtx.ControllerDescriptor.ControllerName,
                actionContext.ActionDescriptor.ActionName
            );

            //the way of saying everything is OK
            return continuation();
        }

        public bool AllowMultiple {
            get {
                return false;
            }
        }
    }
}

When this filter is applied to CarsController, you should see the same result but with better implementation. However, if you need this filter to run for all controller actions, register the filter as a global filter inside the Global.asax file (see Listing 11-5).

Listing 11-5.  Registering LoggerAttribute as a Global Filter

protected void Application_Start(object sender, EventArgs e) {

    //Lines omitted for brevity

    GlobalConfiguration.Configuration.Filters.Add(
        new LoggerAttribute());
}

The capabilities of filters are not limited to these types of scenarios. For example, you can intercept a request with filters and cancel the further execution inside the processing pipeline. Authorization filters are often used for types of scenarios where there is a need to validate the request according to the authorization logic and cancel further execution steps by returning a custom HttpResponseMessage instance.

Default Filter Implementations

Besides filter interfaces, the Web API framework offers default implementation classes of those filters. These abstract classes are intended to make it easier to create custom filters, especially when we don’t need to perform any asynchronous processing. Table 11-2 shows the three base classes we’ll be using in the rest of this chapter.

All of those classes implement the relevant interfaces and are derived from the FilterAttribute class. FilterAttribute is an abstract class; it implements the IFilter interface and is derived from the Attribute class. FilterAttribute also properly sets the AllowMultiple property according to the AttributeUsage attribute’s AllowMultiple property.

Filter Execution Order

As was mentioned earlier, filter types have an execution order relative to each other; but besides that, filter execution order depends on other factors. One of them is the scope of a filter. The filter types have an execution order depending on their scope. For example, if an action Filter A is registered at the controller level and action Filter B is registered at the action level, the Filter A OnActionExecuting method will always run before the Filter B OnActionExecuting method.

If you use the ActionFilterAttribute abstract class as your base class to create action filters, action filters have two methods, as seen in Table 11-2. One is the OnActionExecuting method; the other is OnActionExecuted. As you know, OnActionExecuting runs before the controller action is invoked, and OnActionExecuted runs just after the action method has been executed.

On the other side, when the system runs the filters, they are run in different orders, depending on which method is being executed. For example, IActionFilter.OnActionExecuting filters run in forward order, while IActionFilter.OnActionExecuted filters run in reverse. Let’s look at an example to see these behaviors in action.

Here are two action filters: LoggerAttribute (Listing 11-6) and SecondaryLoggerAttribute (Listing 11-7).

Listing 11-6.  LoggerAttribute Implementation

public class LoggerAttribute : ActionFilterAttribute {

    private const string _loggerName = "Logger";

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        var controllerCtx = actionContext.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuting",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionContext.ActionDescriptor.ActionName
        );
    }

    public override void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuted",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName
        );
    }
}

Listing 11-7.  SecondaryLoggerAttribute Implementation

public class SecondaryLoggerAttribute : ActionFilterAttribute {

    private const string _loggerName = "SecondaryLogger";

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        var controllerCtx = actionContext.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuting",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionContext.ActionDescriptor.ActionName
        );
    }

    public override void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuted",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName
        );
    }
}

LoggerUtil here is a very simple class; it has only one static method to keep our Logger implementation clean (see Listing 11-8).

Listing 11-8.  LoggerUtil Class

public class LoggerUtil {

    public static void WriteLog(
        string loggerName, string loggerMethodName,
        string controllerName, string actionName) {

        var logFormat =
            "{0}, {1} method for Controller {2}, Action {3} is running...";

        Trace.TraceInformation(
            logFormat,
            loggerName,
            loggerMethodName,
            actionName,
            controllerName);
    }
}

Inside our controller the action filters are registered, as shown in Listing 11-9.

Listing 11-9.  CarsController

[Logger]
public class CarsController : ApiController {

    [SecondaryLogger]
    public string[] GetCars() {

        return new string[] {
            "Car 1",
            "Car 2",
            "Car 3",
            "Car 4"
        };
    }
}

The expected behavior here is to see the Logger action filter’s OnActionExecuting method run first and then the SecondaryLogger’s corresponding method run after it. However, the order should be reversed for the OnActionExecuted methods. When the application is run in debug mode, you should see the output result in the Output window (see Figure 11-1).

Exception filters run in reverse order as well. For example, Filter A and Filter B are exception filters. Filter A is registered at the controller level, Filter B at the action level. Normally, Filter A should run before Filter B, but as these are exception filters, Filter B will always run before Filter A.

In addition to these filter behaviors, note that filters may be skipped in some situations. For instance, if the requested is terminated by an action filter, the upcoming action filters won’t be run. At the same time, if there is any other action that has already been executed before the action filter that terminated the request, that action filter’s OnActionExecuted method will be run, but the others won’t.

Let’s look at an example to see this behavior in action. There are now three Logger action filters with the same implementations as Listings 11-6 and 11-7. One of these three filters has a slightly different implementation (see Listing 11-10).

Listing 11-10.  LoggerAttribute Action Filter That Will Terminate the Request

public class LoggerAttribute : ActionFilterAttribute {

    private const string _loggerName = "Logger";

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        //terminate the request by setting a new response
        //to actionContext.Response
        actionContext.Response = new HttpResponseMessage(
            HttpStatusCode.NotFound
        );
    }

    public override void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuted",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName
        );
    }
}

We have registered the Logger action filter at the controller level. At the same time, we have the GlobalLogger action filter registered as a global filter (see Listing 11-11) and the SecondaryLogger action filter applied at the controller action level (see Listing 11-12).

Listing 11-11.  GlobalLogger Action Filter

public class GlobalLoggerAttribute : ActionFilterAttribute {

    private const string _loggerName = "GlobalLogger";

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        var controllerCtx = actionContext.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuting",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionContext.ActionDescriptor.ActionName
        );
    }

    public override void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuted",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName
        );
    }
}

Listing 11-12.  SecondaryLogger Action Filter

public class SecondaryLoggerAttribute : ActionFilterAttribute {

    private const string _loggerName = "SecondaryLogger";

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        var controllerCtx = actionContext.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuting",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionContext.ActionDescriptor.ActionName
        );
    }

    public override void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        LoggerUtil.WriteLog(
            _loggerName,
            "OnActionExecuted",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName
        );
    }
}

So GlobalLogger filter should run first, and the Logger filter second. When the request is terminated by the Logger action filter’s OnActionExecuting method, then the Logger filter’s OnActionExecuted method shouldn’t be run in addition to the SecondaryLogger action filter. Since the GlobalLogger filter’s OnActionExecuting method has already been executed at this point, the system will run its OnActionExecuted method as well (see Figure 11-2).

The same behavior can been seen if the Logger action filter throws an exception instead of terminating the request by setting a new response message.

Action and Controller-Based Filters

Filters can be registered at the controller or action level and this allows control of individual pieces of the framework in terms of filter execution. We generally implement filters as .NET attributes in order to attach them easily at the class and method level, the levels corresponding to controller and action in our case.

If a filter is registered at the controller level (as shown in Listing 11-13), the filter will be applied to all action methods under that controller.

Listing 11-13.  Registering a Filter at the Controller Level

[MyFilter]
public class CarsController : ApiController {

    public string[] GetCars() {
         
        //Lines omitted for brevity
    }
     
    public string[] GetCar(int id) {
     
        //Lines omitted for brevity
    }
}

Doing the same thing for an individual action will ensure that the attached filter will be executed only for that action. For example, the MyFilter filter will be applied only to the GetCars action of CarsController (cf. Listing 11-14).

Listing 11-14.  Registering a Filter at the Action Level

public class CarsController : ApiController {

    [MyFilter]
    public string[] GetCars() {
         
        //Lines omitted for brevity
    }
     
    public string[] GetCar(int id) {
     
        //Lines omitted for brevity
    }
}

Global Filters

Sometimes a filter—an exception filter, for example—might be a good fit for every controller action in an application. Luckily, you don’t have to register it manually for every single controller. The system allow registration of global filters using GlobalConfiguration’s static Configuration property inside Application_Start method in the Global.asax file.

Listing 11-15 shows MyFilter filter registered globally so that it will be applied to every controller action in our application.

Listing 11-15.  Registering a Filter Globally

protected void Application_Start(object sender, EventArgs e) {

    //Lines omitted for brevity

    GlobalConfiguration.Configuration.Filters.Add(new MyFilter());
}

Action Filters

Action filters allow you to inject code to run before the action is invoked and after it is executed. An action filter needs to implement the IActionFilter interface. We’ll be working with the ActionFilterAttribute class (see Listing 11-16), the default implementation of IActionFilter.

Listing 11-16.  ActionFilterAttribute Abstract Class

public abstract class ActionFilterAttribute :
    FilterAttribute, IActionFilter {

    public virtual void OnActionExecuted(
        HttpActionExecutedContext actionExecutedContext);

    public virtual void OnActionExecuting(
        HttpActionContext actionContext);
}

The OnActionExecuting method is the one that runs just before the action is invoked. Inside this method, the framework passes a context class named HttpActionContext, which carries the information related to the request, including controller descriptor, action descriptor, request message, and the like. This context class is used by other filter types as well. Table 11-3 shows the public properties of HttpActionContext class.

The OnActionExecuted method, which runs after the action is executed, is provided with a context class, HttpActionExecutedContext, which carries an HttpActionContext instance, response message details generated by the action, and exception details, if there are any. The HttpActionExecutedContext class is also provided inside the exception filters. Table 11-4 shows the public properties of the HttpActionExecutedContext class.

Here’s an example to show you how an action filter works.

public class Car {

    public int Id { get; set; }

    [Required]
    [StringLength(20)]
    public string Make { get; set; }

    [Required]
    [StringLength(20)]
    public string Model { get; set; }

    public int Year { get; set; }

    public float Price { get; set; }
}

public class CarsContext {

    private static int _nextId = 9;
    private static object _incLock = new object();

    // data store
    readonly static ConcurrentDictionary<int, Car> _carsDictionary = 
        new ConcurrentDictionary<int, Car>(
        new HashSet<KeyValuePair<int, Car>> {
            new KeyValuePair<int, Car>(
                1,
                new Car {
                    Id = 1,
                    Make = "Make1",
                    Model = "Model1",
                    Year = 2010,
                    Price = 10732.2F
                }
            ),
            new KeyValuePair<int, Car>(
                  2, 
                  new Car {
                      Id = 2,
                      Make = "Make2",
                      Model = "Model2",
                      Year = 2008,
                      Price = 27233.1F
                  }
            ),

            //Lines omitted for brevity . . .
    });

    public IEnumerable<Car> All {
        get {
            return _carsDictionary.Values;
        }    }

    public IEnumerable<Car> Get(Func<Car, bool> predicate) {
        return _carsDictionary.Values.Where(predicate);
    }

    public Car GetSingle(Func<Car, bool> predicate) {

        return _carsDictionary.Values.FirstOrDefault(predicate);
    }

    public Car Add(Car car) {

        lock (_incLock) {

            car.Id = _nextId;
            _carsDictionary.TryAdd(car.Id, car);
            _nextId++;
        }

        return car;
    }

}

public class CarsController : ApiController {

    private readonly CarsContext _carsContext = new CarsContext();

    public IEnumerable<Car> GetCars() {

        return _carsContext.All;
    }

    public Car GetCar(int id) {

        return _carsContext.GetSingle(car => car.Id == id);
    }

    public HttpResponseMessage PostCar(Car car) {

        _carsContext.Add(car);

        return new HttpResponseMessage(HttpStatusCode.Created);
    }
}

[AttributeUsage(
    AttributeTargets.Class | AttributeTargets.Method,
    AllowMultiple = false, Inherited = true)]
public class ValidateModelStateAttribute : ActionFilterAttribute {

    public override void OnActionExecuting(
        HttpActionContext actionContext) {

        if (!actionContext.ModelState.IsValid) {

            actionContext.Response =
                actionContext.Request.CreateErrorResponse(
                    HttpStatusCode.BadRequest,
                    actionContext.ModelState);
        }
    }
}

//Lines omitted for brevity

[ValidateModelState]
public HttpResponseMessage PostCar(Car car) {

    _carsContext.Add(car);

    return new HttpResponseMessage(HttpStatusCode.Created);
}

//Lines omitted for brevity

Authorization Filters

Authorization filters inside the Web API framework allow the authorization of the request just before the action filters and controller action are invoked. An authorization filter needs to implement the IAuthorizationFilter interface. We’ll be working with the AuthorizationFilterAttribute class (see Listing 11-22), which is the default implementation of IAuthorizationFilter, which provides the synchronous OnAuthorization method.

Listing 11-22.  AuthorizationFilterAttribute Abstract Class

public abstract class AuthorizationFilterAttribute :
    FilterAttribute, IAuthorizationFilter {

    public virtual void OnAuthorization(
        HttpActionContext actionContext);
}

As already noted several times, an authorization filter runs before any other filter, and its only method, OnAuthorization, is invoked by passing an instance of HttpActionContext class as a parameter. Inside the OnAuthorization method, the request is supposed to be analyzed to authorize the user according to the authorization logic. If the user cannot be authorized by the authorization logic, the request should be terminated. A new response message should be assigned to indicate the unauthorized request.

You’ll see a sample use case, one where a custom authorization filter is implemented, later in this chapter. Before that, let’s explain the use of the AuthorizeAttribute, which is provided inside the framework out of the box as an authorization filter to work with your custom and framework’s built-in authentication features, including forms and windows authentication.

protected void Application_Start(object sender, EventArgs e) {

    //Lines omitted for brevity

    GlobalConfiguration.Configuration.Filters.Add(
        new AuthorizeAttribute());
}

public class AuthController : ApiController {

    //Lines omitted for brevity

    [AllowAnonymous]
    public HttpResponseMessage Post(User user) {
         
        //Lines omitted for brevity
    }
}

[Authorize(Users = "Alex,Tugberk")]
public class CarsController : ApiController {

    //Lines omitted for brevity

    public IEnumerable<Car> Get() {

        //Lines omitted for brevity
    }
}

public class CarsController : ApiController {

    private readonly CarsContext _carsContext = new CarsContext();

    public IEnumerable<Car> Get() {

        return _carsContext.All;
    }
}

public class AuthController : ApiController {

    private readonly AuthorizationService authService =
        new AuthorizationService();

    private readonly FormsAuthenticationService formsAuthService =
        new FormsAuthenticationService();

    [AllowAnonymous]
    public HttpResponseMessage Post(User user) {

        var response = new HttpResponseMessage();

        if (user != null &&
            authService.Authorize(user.UserName, user.Password)) {

            //user has been authorized
            response.StatusCode = HttpStatusCode.OK;
            formsAuthService.SignIn(user.UserName, true);

            return response;
        }

        //if we have come this far, it means that
        //the user hasn't been authorized
        response.StatusCode = HttpStatusCode.Unauthorized;
        response.Content = new StringContent(
            "The user hasn't been authorized.");

        return response;
    }
}

public class AuthorizationService {

    private static List<User> users = new List<User>() {
        new User {
            UserName = "tugberk",
            Email = "[email protected]",
            Password = "12345678"
        },
        new User {
            UserName = "alex",
            Email = "[email protected]",
            Password = "87654321"
        }
    };

    public bool Authorize(string userName, string password) {

        var user = users.FirstOrDefault(
            x => x.UserName == userName);

        if (user == null)
            return false;

        return string.Equals(password, user.Password);
    }
}

public class FormsAuthenticationService {

    public void SignIn(
        string userName,
        bool createPersistentCookie) {

        if (String.IsNullOrEmpty(userName))
            throw new ArgumentNullException("userName");

        FormsAuthentication.SetAuthCookie(
            userName,
            createPersistentCookie);
    }

    public void SignOut() {
         
        FormsAuthentication.SignOut();
    }
}

//Lines omitted for brevity

var apiBaseAddress = "/api/cars";

//Lines omitted for brevity

$.ajax({
    url: apiBaseAddress,
    type: "GET",
    contentType: "application/json; charset=utf-8",
    statusCode: {
        //OK
        200: function(result) {
         
            $.each(result, function(i, data) {
                vm.cars.push(buidCar(data));
            });
        },
        //Unauthorized
        401: function() {
             
            openAuthDialogBox();
        }
    }
});

//Lines omitted for brevity

public override void OnAuthorization(
    HttpActionContext actionContext) {

    if (actionContext.Request.RequestUri.Scheme != Uri.UriSchemeHttps) {

        actionContext.Response = new
            HttpResponseMessage(HttpStatusCode.Forbidden) {
                Content = new StringContent("SSL required")
            };
    }
}

[RequireHttps]
public class CarsController : ApiController {

    public string[] GetCars() {

        return new string[] {
            "Car 1",
            "Car 2",
            "Car 3",
            "Car 4"
        };
    }
}

Exception Filters

An exception filter is a special type of filter; it is invoked only when an exception occurs inside an action and its associated filters. An exception filter needs to implement the IExceptionFilter interface. We will be working with the ExceptionFilterAttribute class (see Listing 11-33), which is the default implementation of IExceptionFilter.

Listing 11-33.  ExceptionFilterAttribute Abstract Class

public abstract class ExceptionFilterAttribute :
    FilterAttribute, IExceptionFilter {

    public virtual void OnException(
        HttpActionExecutedContext actionExecutedContext);
}

The OnException method of ExceptionFilterAttribute is executed when an exception occurs and an instance of an HttpActionExecutedContext class (already covered in Table 11-4) is passed as a parameter to this method. This lets us see exception details through the Exception property of HttpActionExecutedContext class and log the exception however we see fit.

To demonstrate use of this filter, Listing 11-34 shows a custom exception filter that writes the exception details to the trace.

Listing 11-34.  HandleErrorAttribute Exception Filter Implementation

public class HandleErrorAttribute : ExceptionFilterAttribute {

    public override void OnException(
        HttpActionExecutedContext actionExecutedContext) {

        var actionCtx = actionExecutedContext.ActionContext;
        var controllerCtx = actionCtx.ControllerContext;

        Trace.TraceInformation(
            "Exception occured. Controller: {0}, action: {1}. Exception message: {2}",
            controllerCtx.ControllerDescriptor.ControllerName,
            actionCtx.ActionDescriptor.ActionName,
            actionExecutedContext.Exception.Message);
    }
}

Listing 11-35 shows how this filter is registered at the controller level.

Listing 11-35.  CarsController with HandleError Exception Filter

[HandleError]
public class CarsController : ApiController {

    public string[] GetCars() {

        throw new Exception();

        return new string[] {
            "Car 1",
            "Car 2",
            "Car 3",
            "Car 4"
        };
    }
}

Notice that we’ve thrown an exception on purpose inside our action method to test its functionality. So we should see the exception details being written to the Output window when the application is run under debug mode (see Figure 11-15).

You can use your favorite logging library to log exceptions (NLog, Elmah, etc.). It’s pretty easy to wire them up with exception filters.