title: Custom AuthorizeAttribute on WebApi OData EntitySetController
body: <p>I created custom authorize attribute to handle my custom permissions on WebAPI odata controller inherited from EntitySetController, here is the code for my attribute </p>
  
  
  
  <pre class="lang-cs prettyprint-override"><code>[AttributeUsage(AttributeTargets.Method, Inherited = false, AllowMultiple = false)]
  public class RequirePermissionsAttribute : System.Web.Http.AuthorizeAttribute
  {
      public Permissions[] Permissions { get; set; }
  
  
      public RequirePermissionsAttribute()
      { }
  
      public RequirePermissionsAttribute(params Permissions[] permissions)
      {
          this.Permissions = permissions;
      }
  
      public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
         // Custom  authorization logic
      }
  </code></pre>
  
  <p>Now I try to add this attribute on Get() method, it get invoked</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class ItemsController : EntitySetController&lt;Item, Guid&gt;
  {
     [EnableQuery(MaxExpansionDepth = 5)]
     [RequirePermissionsAttribute(Permissions.ViewAll)]
     public override IQueryable&lt;Item&gt; Get()
     {
       //Code go here
     }
  }
  </code></pre>
  
  <p>But when I add the same attribute on CreateEntity() it never get invoked</p>
  
  <pre class="lang-cs prettyprint-override"><code>[RequirePermissionsAttribute(Permissions.Add)]
  protected override Item CreateEntity(Item item)
  {
    // Create item
  }
  </code></pre>
  
  <p>Any help appreciated </p>