It is common practice to use an Authentication and an Authorization filter simultaneously. With WebForms, we could add custom Authentication programmatically per page, but it is laborious.
MVC brought to WebApplications more granularity for authentication. Now, we can add Authentication at action, controller, or global level, according to the needs of our actions in a website. It was first executed before all the MVC filters.
The Authentication filter doesn't exist anymore in ASP.NET MVC 6 (maybe it's not ported yet).
Before ASP.NET Core, it was possible to create our own Authorization attribute by inheriting from FilterAttribute and IAuthenticationFilter.
For example, we use it to return a specific HTTP status code, action ...
