title: ASP.NET Web API Override authorization filter for a handler
body: <p>How can I disable an authorization filter for a specific GET handler in Web API? </p>
  
  <p>There's a custom authorization filter on the class level but for one of the methods I need to have no security.  I tried applying <code>[AllowAnonymous]</code> attribute but it still runs through the higher-level filter and fails. That custom filter derives from <code>AuthorizationFilterAttribute</code>. The class also have two another attributes: <code>OverrideAuthentication</code> and <code>EnableCors</code>.</p>
  
  <p>I tried <code>AllowAnonymous</code> attribute but it doesn't.</p>
  
  <p>Sample code:</p>
  
  <pre><code>[EnableCors(origins: "*", headers: "*", methods: "*")]
  [OverrideAuthentication]
  [AccountAuthorization]
  public class AccountsController : ApiController
  {
  
      [Route("api/accounts/{accountNumber}/GetX")]
      [AllowAnonymous]
      [HttpGet]
      public HttpResponseMessage GetX(string accountNumber)
      {
          HttpResponseMessage response = null;
          IEnumerable&lt;string&gt; apiKey;
          if (!Request.Headers.TryGetValues("X-ApiKey", out apiKey) || apiKey.Count() != 1 || apiKey.First() != API_KEY)
          {
              throw new HttpResponseException(HttpStatusCode.Forbidden);
          }
  
          // Process
          // ..
          // ..
  
          return response;
      }
  }
  </code></pre>
  
  <p><strong>EDIT:</strong> The linked answer doesn't explain what's the solution.</p>