asp.net mvc 5 - What is the difference between using AuthorizeAttribute or IAuthorizationFilter? -

authorizeattribute requires override onauthorization method , iauthorizationfilter requires implement onauthorization method. seems same thing me, there other differences? why 1 used on other?

edit: clarify, i'm trying understand difference between following 2 pieces of code.

public class passwordexpirationcheckattribute : authorizeattribute {     private int _maxpasswordageindays;      public passwordexpirationcheckattribute(int maxpasswordageindays)     {         _maxpasswordageindays = maxpasswordageindays;     }      public override void onauthorization(authorizationcontext filtercontext)     {         if (!filtercontext.actiondescriptor.getcustomattributes(typeof(bypasspasswordexpirationcheckattribute), true).any())         {             iprincipal userprincipal = filtercontext.requestcontext.httpcontext.user;             if (userprincipal != null && userprincipal.identity.isauthenticated)             {                 var userstore = new applicationuserstore(new identitydb());                 var usermanager = new applicationusermanager(userstore);                 var user = usermanager.findbynameasync(filtercontext.requestcontext.httpcontext.user.identity.name).result;                  if (user != null)                 {                     var timespan = datetime.today.date - user.lastpasswordchangeddate.date;                     if (timespan.totaldays >= _maxpasswordageindays)                     {                         httpcontextbase httpcontextbase = new httpcontextwrapper(httpcontext.current);                         requestcontext requestcontext = new requestcontext(httpcontextbase, new routedata());                         urlhelper urlhelper = new urlhelper(requestcontext);                          filtercontext.httpcontext.response.redirect(urlhelper.action("changepassword", "manage"));                     }                 }             }         }                      base.onauthorization(filtercontext);     } } 

and...

public class passwordexpirationcheckattribute : iauthorizationfilter {     private int _maxpasswordageindays;      public passwordexpirationcheckattribute(int maxpasswordageindays)     {         _maxpasswordageindays = maxpasswordageindays;     }      public void onauthorization(authorizationcontext filtercontext)     {         if (!filtercontext.actiondescriptor.getcustomattributes(typeof(bypasspasswordexpirationcheckattribute), true).any())         {             iprincipal userprincipal = filtercontext.requestcontext.httpcontext.user;             if (userprincipal != null && userprincipal.identity.isauthenticated)             {                 var userstore = new applicationuserstore(new identitydb());                 var usermanager = new applicationusermanager(userstore);                 var user = usermanager.findbynameasync(filtercontext.requestcontext.httpcontext.user.identity.name).result;                  if (user != null)                 {                     var timespan = datetime.today.date - user.lastpasswordchangeddate.date;                     if (timespan.totaldays >= _maxpasswordageindays)                     {                         httpcontextbase httpcontextbase = new httpcontextwrapper(httpcontext.current);                         requestcontext requestcontext = new requestcontext(httpcontextbase, new routedata());                         urlhelper urlhelper = new urlhelper(requestcontext);                          filtercontext.httpcontext.response.redirect(urlhelper.action("changepassword", "manage"));                     }                 }             }         }                      return;     } } 

iauthorizationfilter interface. nothing. if wanted use it, you'd have implement own authorization attribute implements interface ground up.

authorizeattribute, on other hand, works out of box. implements iauthorizationfilter , takes care of common needs of developers. still allows override onauthorization method in case want extend functionality, don't have to, works fine without doing that.