Event handlers in C# should generally inherit HandlerBase or a subclass of it. If you require custom behavior you can implement IHandler directly but generally you should not need to.

Although you could do authorization on a per handler bases, generally we recommend you create different subclasses of HandlerBase that create contexts of authorization within your app. For example:

	public abstract class AdminHandlerBase<TReq> : HandlerBase<TReq, IMyAppPrinciple> where TReq : RequestBase
	{
		protected override bool IsAuthorized(TReq request, IMyAppPrinciple principal)
		{
			return principal.IsInRole(RoleEnum.SiteAdmin);
		}
	}

These reusable Base classes help ensure consistent authorization across your app.