title: ASP.NET Web API always returns 401 unauthorized error
body: <p>I am using Custom authorization on asp.net web api.I have followed the following link 
  <a href="http://www.codeproject.com/Tips/376810/ASP-NET-WEB-API-Custom-Authorize-and-Exception-Han" rel="nofollow">http://www.codeproject.com/Tips/376810/ASP-NET-WEB-API-Custom-Authorize-and-Exception-Han</a>
  I use the attribute name in my controller like this    </p>
  
  <p>[mycustomattribute]</p>
  
  <p>public class userController : apicontroller
  {</p>
  
  <p>}</p>
  
  <p>but it always shows 401 unauthorized exception inspite of authentication status being authorized. I have followed exactly wat it is in the link for creating custom authorize attribute.    </p>
  
  <p><strong>my custom authorize class</strong></p>
  
  <pre><code> public class tokenAuthorize : AuthorizeAttribute
  {
      DBEntity _objScrumDBEntities = new DBEntity ();
      public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          base.OnAuthorization(actionContext);
          if (actionContext.Request.Headers.GetValues("authenticationToken") != null)
          {
              // get value from header
              string authenticationTokenValue = Convert.ToString(actionContext.Request.Headers.GetValues("authenticationToken").FirstOrDefault());
              ObjectParameter m_tokenParam = new ObjectParameter("status", typeof(string));
              _objScrumDBEntities.validateToken(authenticationTokenValue, m_tokenParam);
             string status = Convert.IsDBNull(m_tokenParam.Value) ? null : (string)m_tokenParam.Value;
              if (status == "false")
              {
                  HttpContext.Current.Response.AddHeader("authenticationToken", authenticationTokenValue);
                  HttpContext.Current.Response.AddHeader("AuthenticationStatus", "NotAuthorized");
                  // actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
                   return;
              }
  
              else
              {
                  HttpContext.Current.Response.AddHeader("authenticationToken", authenticationTokenValue);
                  HttpContext.Current.Response.AddHeader("AuthenticationStatus", "Authorized");                
                  return;
  
              }
              //return;
          }
          //actionContext.Response =  actionContext.Request.CreateResponse(HttpStatusCode.ExpectationFailed);
          //else
          // actionContext.Response.ReasonPhrase = "Please provide valid inputs";
      }
  }
  </code></pre>
  
  <p>and my controller </p>
  
  <pre><code>[tokenAuthorize] 
  public class myController : ApiController
  {
  
      public IEnumerable&lt;organization&gt; Get()
      {
          return _objOrgRepository.GetAll();
      }
  </code></pre>