title: If I add a constructor to an extension of the AuthorizeAttribute will the constructor be called on every request that has the attribute attached?
body: <p>I have written a custom extension of the the <code>System.Web.Mvc AuthorizeAttribute</code>.<br> The Microsoft Reference here : <a href="https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute.-ctor?view=aspnet-mvc-5.2#System_Web_Mvc_AuthorizeAttribute__ctor" rel="nofollow noreferrer">SystemWebMvcAuthorizeAttribute</a>.</p>
  
  <p>This extension overrides the <code>AuthorizeCore</code> function from <code>AuthorizeAttribute</code>, and the intended use is that this custom attribute will retain the existing functionality of <code>AuthorizeAttribute</code>, but also perform an additional check on the user's session if a <code>config</code> setting is set to true.</p>
  
  <p>We are worried about performance since this custom attribute will be attached to every API request, replacing the currently used <code>Authorize</code> attribute. Currently, in the <code>AuthorizeCore</code> function, we are reading the <code>config</code> setting on every single request, and are wondering if there is a better way of doing things.</p>
  
  <p>So, if I create a constructor for my custom attribute, read the <code>config</code> there, and then store it in a <code>static</code> variable, does anyone know if this constructor will be called on every single request made which has this custom attribute attached, or just once, and then every call to <code>AuthorizeCore</code> (invoked when a request is made) can refer to the <code>static</code> variable storing the value that has already been read from the <code>config</code>?</p>
  
  <pre><code>public class AuthorizeSessionAttribute : AuthorizeAttribute
  {
      bool _manageSession = false;
  
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          // Since we are overriding the AuthorizeCore from AuthorizeAttribute, make sure to call the base method first to check that this request 'isAuthorized' before proceeding.
          bool isAuthorized = base.AuthorizeCore(httpContext);
  
          if (isAuthorized)
          { 
              // Any way to improve this?
              bool.TryParse(ConfigurationManager.AppSettings["ManageSession"], out _manageSession);
  
              if (_manageSession)
              {
                  // custom logic goes here
              }
          }
          return isAuthorized;
      }
  }
  
  
  </code></pre>