title: How do I use request-specific information in attribute-based MVC authorization?
body: <p>I'm working on an app that uses an ApplicationFilter to secure some controller actions, like this:</p>
  
  <pre><code>[MustLogInOrPay]
  public virtual ActionResult DownloadImage( int imageId ) {
  ...
  }
  </code></pre>
  
  <p>So, MustLogInOrPay extends ActionFilterAttribute, and it redirects them, if necessary, to a page where the user either logs in or pays and then continues on to where they were going. Seems to work fine.</p>
  
  <p>I want to make the authorization smarter and allow a user who has paid to download the same image an unlimited number of times during their session, to mitigate the chances of them being frustrated if the initial download fails.</p>
  
  <p>Unfortunately the code making the decisions is in MustLogInOrPay, and that doesn't have the imageId available to it. So the only two ways forward that I know of are 1) Have MustLogInOrPay's code dig into the raw request to find the imageId, which sounds yucky, or 2) Begin DownloadImage with the code that is currently inside MustLoginOrPay, essentially throwing the Attribute-based mechanism in the garbage. Is there a better way? What is the best practice for using request-specific information inside a global authorization filter?</p>