title: Custom MVC AuthorizeAttribute for ASP.NET Web API
body: <p>I am trying to implement a custom authorization attribute on my Web API controllers, but came across an unexpected behavior.</p>
  
  <pre><code>     &lt;Authorize(Users:="myUser")&gt;
       Public Function GetTodoItems() As IQueryable(Of TodoItem)
  </code></pre>
  
  <p>The above code works very well: It will allow <em>"myUser"</em> to retrieve the items, bot nobody else is allowed access. However, when I try the same approach with my custom authorization, the entire check is skipped, and any user can access the resource. Neither the <code>AuthorizeCore</code> nor the <code>OnAuthorization</code> overridden methods in my derived class are called.</p>
  
  <pre><code>     &lt;MyAuth(Users:="myUser")&gt;
       Public Function GetTodoItems() As IQueryable(Of TodoItem)
  </code></pre>
  
  <p>The derived class inherits from <code>System.Web.Mvc.AuthorizeAttribute</code>, and the project is deployed on IIS, with <em>Windows Authentication</em> &amp; <em>Impersonation enabled</em>, and <em>Anonymous Authentication</em> disabled.</p>
  
  <p>If I add the same custom authorization to an MVC Controller, then it works. But on the API Controllers, nothing. If the <code>Authorize</code> attribute wouldn't have worked either, it would have made more sense. Am I missing something? Is this an expected behavior, or a bug in the Beta?</p>