title: How to use the Authorize attribute both at the controller and action level?
body: <p>I have implemented my own custom Authorize attribute.</p>
  
  <p>The attribute is applied both at the controller level and at the action level.</p>
  
  <p>Here is an example of what I need to do:</p>
  
  <pre><code>[ClaimsAuthorize(Roles = "AdvancedUsers")]
  public class SecurityController : Controller
  {
      [ClaimsAuthorize(Roles = "Administrators")]
      public ActionResult AdministrativeTask()
      {
          return View();
      }
  
      public ActionResult SomeOtherAction()
      {
          return View();
      }
  }
  </code></pre>
  
  <p>Currently if a user has the Administrator Role but not the AdvancedUsers role, he cannot execute "Administrative Task".</p>
  
  <p>How can I change this behavior to perform a security check at the action level even if the user is not authorized at the controller level?</p>
  
  <p>For the moment, the only solution I can think about is to implement 2 attributes: one for securing controllers, another for securing actions. Then I would play with the Order property to execute the one at the action level first.</p>
  
  <p>However, I would prefer a solution with a single attribute if possible.</p>