title: Does anyone have a good explanation on how the [Authorize] Attribute handles routes in a standard ASP.NET MVC 5 application?
body: <p>As you can see <a href="https://stackoverflow.com/questions/32899770/asp-net-mvc-5-authorize-attribute-is-generating-login-pop-up-in-browser-instea">from my previous post</a>, I've been having a lot of difficulty with MVC 5's <code>[Authorize]</code> attribute. The dev team in the shop next door can't figure out why the attribute keeps failing in every new project I create in Frameworks 4.5.2, 4.5.3, or 4.6 (By fail, I mean that decorating an action method with the attribute will automatically redirect all users, authorized or no, to a 401 page). My new standard practice is to create a custom attribute inheriting from <code>AuthorizeAttribute</code> in every membership system I build, but this is obviously not ideal.</p>
  
  <p>MSDN doesn't have any code-based explanation of how the attribute actually reroutes unauthorized users to the login page (the expected behavior), which is the critical insight that's needed in order to determine whether the true bug lies in my codebase, or is instead a quirk in the IIS host settings. Anyone out there able to white-box this attribute once and for all?</p>