title: Web Api Custom Authorize Attribute Properties
body: <p>I'm trying to extend he default Web Api authorize attribute to allow authenticated users to have access to a set of actions even though they are not registered in the application (e.g., they don't have a role).</p>
  
  <pre><code> public class AuthorizeVerifiedUsersAttribute : AuthorizeAttribute
      {
          /// &lt;summary&gt;
          /// Gets or sets the authorized roles.
          /// &lt;/summary&gt;
          public new string Roles { get { return base.Roles; } set { base.Roles = value; } }
  
          /// &lt;summary&gt;
          ///  Gets or sets the authorized users.
          /// &lt;/summary&gt;
          public new string Users { get { return base.Users; } set { base.Users = value; } }
  
          private bool _bypassValidation;
          /// &lt;summary&gt;
          /// Gets of sets a controller or an action as an authorization exception
          /// &lt;/summary&gt;
          public virtual bool BypassValidation
          {
              get
              {
                  Debug.WriteLine("get:" + TypeId.GetHashCode() + " " + _bypassValidation);
                  return _bypassValidation;
              }
              set
              {
                  Debug.WriteLine("set:" + TypeId.GetHashCode() + " " + value);
                  _bypassValidation = value;
              }
          }
  
          protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
          {
              if (HttpContext.Current.User.Identity.IsAuthenticated)
              {
                  if (BypassValidation)
                  {
                      return true;
                  }
                  else
                  {
                     //return false if user is unverified
  
                  }
              }
  
              return base.IsAuthorized(actionContext);
          }
      }
  </code></pre>
  
  <p>And it is being used like this: </p>
  
  <pre><code> [AuthorizeVerifiedUsers]
   public class UserProfileController : ApiController
   {
  
      [AuthorizeVerifiedUsers(BypassValidation = true)]
      public bool Verify(string verificationCode)
      {}
   }
  </code></pre>
  
  <p>So far this action is the only that is using the BypassValidation = true.</p>
  
  <p>The issue arises because the BypassValidation property is false for the action even though the Debug window - used in the BypassValidation property - shows the following:</p>
  
  <p>set:26833123 True
  set:39602703 True
  get:43424763 False
  get:43424763 False
  get:43424763 False //call that should have "True"...</p>
  
  <p>I noticed two things:</p>
  
  <ul>
  <li>The TypeId (The unique identifier for the attribute) is different between the calls that have BypassValidation = true and the ones that have BypassValidation = false. </li>
  <li>The id '43424763' doesn't have a corresponding set</li>
  </ul>
  
  <p>Any ideas?</p>
  
  <p>Thanks in advance,
  Joao</p>