asp.net-mvc – 在自定义控制器工厂中进行通用授权的良好做法？

clients/{clientId}/{controller}/{action}/{id}

示例网址：

clients/1/orders/details/1
clients/2/children/index
clients/2/cars/create

您需要为客户提供适当的授权.我不想在每个控制器中执行相同的客户端授权.我提出了在自定义控制器工厂中进行自动化的想法,如下所示：

public class CustomControllerFactory : DefaultControllerFactory
{
    private readonly IAuthService _authService;

    public CustomControllerFactory(IAuthService authService)
    {
        _authService = authService;
    }

    protected override IController GetControllerInstance(
        RequestContext requestContext,Type controllerType)
    {
        var doAuth = requestContext.RouteData.Values.ContainsKey("clientId");
        if (doAuth)
        {
            var principal = requestContext.HttpContext.User;
            var clientId = long.Parse(
                requestContext.RouteData.Values["clientId"].ToString());
            var authorized = _authService.Client(principal,clientId);
            if (!authorized)
            {
                return new AuthController();
            }                
        }
        return base.GetControllerInstance(requestContext,controllerType);
    }
}

你认为这是一个好习惯吗？为什么？