title: Custom AuthorizeAttribute being called too many times
body: <p>I am currently developing some security to protect web service calls. I decided to extend the authorize attribute and overide the isAuthorized function as well as the ActionFilterAttribute OnActionExecuted. However, as i was debugging the program, i noticed that if i was to add [Authorize(Roles = "Read")] class level and [Authorize(Roles = "Admin")] on a api function within that class, The isAuthorized is being called 3 times in total. This might not be too big of an issue but since in my isAuthorized, i am creating and validating tokens in a database. It would be ideal if i am able to eliminate this redundant process and work with just isAuthorized being called once per service call.</p>
  
  <pre><code>  public class CustomuAuthorizeAttribute : AuthorizeAttribute
  {
  
      protected override bool IsAuthorized(HttpActionContext actionContext)
      {
          bool allowedAccess = true;
          ... logic
  
      }
     }
  </code></pre>
  
  <p>Overriding the OnAction Executed. This actually only gets hits once eventhough the isAuthorized gets hit 3 times. </p>
  
  <pre><code>    public class CustomAuthorizeFilter : ActionFilterAttribute
  {
  
      public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
      {
       .. logic
      }
  }
  </code></pre>
  
  <p><strong>Edit</strong>
  I have found that adding [AttributeUsage(AttributeTargets.Method| AttributeTargets.Class)] onto the authorizeattribute calss solves the issue of being called multiple times</p>