Move authorization filters to be the first set of filters to run

[rynowak]

Authorization filters come before the new resource filters stage, and are the first piece of user code to run after action selection.

Throwing from an authorization filter is considered a programming error, and will bubble up to middleware (not handled by exception filters).

See updated diagram:

[pranavkm]

Out of curiosity, what would one do in a resource filter on the way out?

[rynowak]

Out of curiosity, what would one do in a resource filter on the way out?

The same kinds of things you can do in a result filter... except a resource filter always runs. Result filters only run if a successful result was produced by the action or by an action filter.

[rynowak]

0152aac