title: WebApi Custom Authorize Attribute not working
body: <p>I need to protect my web api with one or more specific users from the active directory, in the web.config I have the following code:</p>
  
  <pre><code>&lt;configSections&gt; 
      &lt;section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /&gt;
  
      &lt;section name="users" type="System.Configuration.NameValueFileSectionHandler,System, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" /&gt;
  
    &lt;/configSections&gt; 
    &lt;users&gt; 
      &lt;add key="user" value="domain\loginname" /&gt; 
    &lt;/users&gt; 
    &lt;system.web&gt; 
      &lt;authentication mode="Windows" /&gt; 
      &lt;compilation debug="true" targetFramework="4.5" /&gt; 
      &lt;httpRuntime targetFramework="4.5" /&gt; 
    &lt;/system.web&gt;
  </code></pre>
  
  <p>Then I have a custom authorize attribute which reads the user  from the web.config section shown above.</p>
  
  <pre><code>public class MyAuthorizeAttribute : AuthorizeAttribute
      {
  
          public MyAuthorizeAttribute(params string[] userKeys)
          {
              List&lt;string&gt; users = new List&lt;string&gt;(userKeys.Length); 
              var allUsers = (NameValueCollection)ConfigurationManager.GetSection("users");
              foreach (var userKey in userKeys)
              {
                  users.Add(allUsers[userKey]);
              }
  
              this.Users = string.Join(",", users);
          }
  
          protected override bool AuthorizeCore(HttpContextBase httpContext)
          {
              bool isAuthorized = base.AuthorizeCore(httpContext);
              bool isRequestHeaderOk = false;
              return isAuthorized &amp;&amp; isRequestHeaderOk;
          }
      }
  </code></pre>
  
  <p>The problem is that the Authorize Core is never hit in the debugger, the JSON in the browser is always shown even if I put a hardcoded false , the breakpoint is never hit there.</p>
  
  <p>Then I decorate my controllers with the custom authorize attribute</p>
  
  <pre><code>[MyAuthorize("user")]
          [ResponseType(typeof(tblCargo))]
          public IHttpActionResult GettblCargosByActivo()
          {
              var query = from c in db.tblCargos
                          orderby c.strCargo
                          select c;
  
              //var result = Newtonsoft.Json.JsonConvert.SerializeObject(query);
              //return result;
  
              return Ok(query);
          }
  </code></pre>
  
  <p>And in IIS, the only enabled method is Windows Authentication</p>
  
  <p>when I browse to the site from another computer, then I get the authentication window, but the authoze method shown above is never hit.</p>
  
  <p>THis is a nice post that lead me to the right direction (I believe)
  <a href="https://stackoverflow.com/questions/26464848/custom-authorization-in-asp-net-webapi-what-a-mess">Custom Authorization in Asp.net WebApi - what a mess?</a></p>