CustomAuthorizeAttribute - HttpActionContext instead of AuthorizationContext

Question

I'm attempting to create a custom authorize attribute in MVC4/Razor and am having an issue with the "AllowAnnoymous" attribute running under the custom authorize attribute (it seems to ignore it). That's all fine and dandy, as I found a solution (see below) to that by checking if the controller or action contain an allow anonymous attribute and then allow pass through if so.

However, I'm seeing that when I create the "AuthorizeAttribute" class and attempt to implement "OnAuthorization" override, it sets the object handlers to a type of "AuthorizationContext" but in the below example and many others i've found on here, it seems the "AuthorizationContext" should not be used - instead it should be "HttpActionContext". Though I tried to replace it with "HttpActionContext" and the override then fails saying there is no suitable method. Any ideas on what I'm missing/doing wrong?

Example Found Here (By Jammer)

private static bool SkipAuthorization(HttpActionContext actionContext)
{
    Contract.Assert(actionContext != null);

    return actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any()
               || actionContext.ControllerContext.ControllerDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any();
}

public override void OnAuthorization(HttpActionContext actionContext)
{
        base.OnAuthorization(actionContext);
}

My Code

private override void OnAuthorization(AuthorizationContext filterContext) // Not sure how to change this to HttpActionContext
{
    if (filterContext == null) throw new ArugmentException("filterContext");
    if (!AllowAnnonymous(new HttpActionContext()))
    {
        throw new HttpResponseException(HttpStatusCode.UnAuthorized);
    }
    else
    {
        base.OnAuthorization(filterContext);
    }
}

Answer 1

Any ideas on what I'm missing/doing wrong?

First of all, you are looking at an example that uses the Web API System.Web.Http.AuthorizeAttribute instead of the MVC System.Web.Mvc.AuthorizeAttribute. MVC and Web API are separate frameworks and neither will recognize the other's attributes. This is also the reason why you have a different context type in your AuthorizeAttribute.

Secondly, the reason your custom AuthorizeAttribute doesn't recognize AllowAnonymousAttribute is because you are overriding the logic that does that check in OnAuthorization (along with other important logic that deals with output caching). If you instead override AuthorizeCore and return true/false, then you will not skip this important logic.

If you need to change where the user is redirected, you can override HandleUnauthorizedRequest, which only executes when authorization fails.

Finally, if you need to access the ActionDescriptor to scan for your own attributes, it is passed into OnAuthorization via AuthorizationContext.ActionDescriptor. Unfortunately, it is not passed into AuthorizeCore automatically, but you can work around this by setting it to HttpContext.Items in OnAuthorization as in this example.