I'm building an Asp.Net Web API (not Core).

I need to extract a custom, HTTP header before each controller action executes (excluding GET/session/create and POST /session/create) and create a session variable:

// extract header HttpContext httpContext = HttpContext.Current; NameValueCollection headerList = httpContext.Request.Headers; var token = headerList.Get("X-SAP-LogonToken"); // enterpriseSession needs to be available in each action for additional processing ISEnterpriseSession enterpriseSession = null; using ( SessionMgr sessionMgr = new SessionMgr() ) { try { ISEnterpriseSession enterpriseSession = sessionMgr.LogonWithToken(token); } catch (Exception e) { // if the token is invalid, return 401; TODO: handle other exceptions properly return Unauthorized(); } }; 

What's the recommend way to implement this? An ActionFilterAttribute, perhaps? What's the recommend way to scope the ISEnterpriseSession variable so that's accessible to the action? If I would like to return the custom header in the response, how is that done? Adding it to the HttpResponseMessage?

If I decorate a controller's action with [Anoymous], will it skip the code to extract a header and create a session?