No, it’s not wrong. BuildUp is for property injection, which I see as a bit of a compromise. It’s more difficult to configure that way (I have to explicitly tell the container what it needs to pay attention to), and I find it to be less explicit. It’s perfectly acceptable. I try and avoid it at all costs, when it’s just not possible to get my own ctor in there somewhere.

public class CPOPAuthorizeAttribute : AuthorizeAttribute
{
private ISecurityService securityService; // will be setter injected

public ISecurityService SecurityService
{
get { return securityService; }
set { securityService = value; }
}

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
throw new ArgumentNullException(“httpContext”);

if (!httpContext.User.Identity.IsAuthenticated)
return false;

ObjectFactory.BuildUp(this);

return false;

}

}

Am I doing something glaring wrong (to everyone but me)?

Good call, thanks for the heads up!

If you intend to use a custom action invoker from an AsyncController, be sure to inherit from AsyncControllerActionInvoker rather than ControllerActionInvoker. Otherwise, your asychronous methods will get dispatched as standard synchronous methods. For AsyncController, the AsyncControllerActionInvoker ultimately triggers the method name matching that pairs ActionNameAsync with ActionNameCompleted.

This wasn’t immediately obvious to me and took some time to trace down the root cause.

What version of MVC are you using? This example is for MVC 2.