title: Passing objects between AuthorizeAttribute and Controller
body: <p>To authorize a GET request for an item by Id, I query for the item in a custom <code>AuthorizeAttribute</code> to verify the authenticated user has access. To prevent duplicating the query in the <code>ApiController</code> action, I want to pass the object from the <code>AuthorizeAttribute</code> to the action.</p>
  
  <p>Since the <code>AuthorizeAttribute</code> is called in the pipeline before the <code>ActionArgument</code> binders have run, I cannot pass the object via <code>HttpActionContext.ActionArguments</code>. I am also wary of serializing it into a querystring and potentially running up against the length limit.</p>
  
  <p>One option for passing the item is stashing it in <code>HttpContext.Current.Items</code> and casting it upon retrieval in the action. I have read that this will work even in asynchronous actions, but there seems to be considerable advice against using the <code>Items</code> dictionary.</p>
  
  <p>Should I simply re-query for the item in the action? Is using the <code>Items</code> dictionary appropriate? Is it appropriate to use an <code>ActionFilterAttribute</code> for this purpose to allow for access to <code>HttpActionContext.ActionArguments</code> even though I am using it for authorization? Is there another vector that I have overlooked?</p>