title: WebApi Custom Authorize attribute
body: <p>I've been grindign me head over this one.
  I've been trying to implement a custom authorize attribute for a WebApi. I've read multiple articles on how to do this, but for some reason the authorization is never executed.</p>
  
  <pre><code>public class ActivityAuthorizeWebApiAttribute : System.Web.Http.AuthorizeAttribute
  {
      private string[] Activities { get; set; }
      public string Activity
      {
          set
          {
              this.Activities = value.Split(',').Select(x =&gt; x.Trim()).ToArray();
          }
          get { return string.Join(",", this.Activities); }
      }
  
      public ActivityAuthorizeWebApiAttribute()
      {
      }
  
      protected override bool IsAuthorized(HttpActionContext actionContext)
      {
          var principalUser = HttpContext.Current.User;
          if (principalUser == null || !principalUser.Identity.IsAuthenticated)
          {
              return false;
          }
  
          if (!principalUser.Activities().Any())
          {
              var activityProvider = (IActivityProvider)GlobalConfiguration.Configuration.DependencyResolver.GetService(typeof(IActivityProvider));
              var activities = activityProvider.GetActivitiesByRoleId(principalUser.Identity.GetUserId());
              principalUser.SetActivities(activities);
  
          }
  
          return principalUser.HasAnyActivity(this.Activities.ToList());
  
          //check your permissions
      }
  
  }
  </code></pre>
  
  <p>As i can see i'm inheriting from the correct AuthorizeAtribute, not the mvc one. But the IsAuthorized method is never called.
  The controller action</p>
  
  <pre><code>[ActivityAuthorizeWebApi(Activity = "Home")]
  public IEnumerable&lt;string&gt; Get()
  {
      return new string[] { "value1", "value2" };
  }
  </code></pre>
  
  <p>Could it be because of the combination with the bearer token Authentication?</p>
  
  <p>Edit:
  I've even tried just this code:</p>
  
  <pre><code>public class CustomAuthorize : System.Web.Http.AuthorizeAttribute
  {
  }
  </code></pre>
  
  <p>As custom code, and not authorze is executed.</p>