Question

Is it possible to stack several custom AuthorizeAttribute on a controller?

I tried doing something like this:

[IsOwner]
[IsFranchisee]
public class CartController : Controller
{
    ...
}

but it’s behavior is erratic. Sometimes it works, sometimes it doesn’t (mostly the latter).

Answer 1

Are you sure your implementation is correct?
I’m asking because there is no guaranteed order with FilterAttributes, (which AuthorizeAttribute derives from) unless you set the Order property.

Because you said the behavior is erratic, I was thinking maybe one attribute cancels the other out. For example your user IsOwner == true, but IsFranchisee == false. Maybe whether or not permission is granted depends on which executes first?

So, you could try giving your attributes an order property and see if the behavior is still erratic