I have a custom authorize attribute like this :
public class AuthorizeApplicationAttribute : AuthorizeAttribute {
    private MainServiceSoapClient client;
    public AuthorizeApplicationAttribute() {
        this.client = new MainServiceSoapClient();
    }
    public AuthorizeApplicationAttribute(MainServiceSoapClient client) {
        this.client = client;
    }
    protected override bool IsAuthorized(HttpActionContext actionContext) {
        if (!base.IsAuthorized(actionContext)) return false;
        var currentUser = System.Web.Security.Membership.GetUser();
        if (currentUser == null) return false;
        var userId = (int)currentUser.ProviderUserKey;
        return client.HasPermission(userId);
    }
}
which I register in WebApiConfig as :
public class WebApiConfig {
    public static void Register(HttpConfiguration config) {
        // Web API configuration and services
        config.Filters.Add(new AuthorizeApplicationAttribute());
        // more configuration ...
    }
}
but AuthorizeAttribute doesn't have a dispose, I can call the constructor with the soap client instance, but then I'm not sure where to dispose it.
FYI: I'm not using a IoC container. Trying to learn how to make it manually.
This example uses a SoapClient but I have the same question about a DbContext while I can live without disposing DbContext and don't think not disposing a WCF Client will be that good.
 
     
     
    