title: Attribute methods derived from System.Web.Http.AuthorizeAttribute class are not called in Web Api 2
body: <p>I want to derive an attribute from <code>System.Web.Http.AuthorizeAttribute</code> as follows:</p>
  
  <pre><code>using System.Web.Http.Controllers;
  using WebApi = System.Web.Http;
  
  namespace Memzuc.Net.Authorization {
      [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
      public class AuthorizeAttribute : WebApi.AuthorizeAttribute {
          private static Logger logger = LogManager.GetCurrentClassLogger();
  
          public AuthorizeAttribute() : base() {
              logger.Debug("Memzuc.Net.Authorization.AuthorizeAttribute ctor");
          }
  
          protected override bool IsAuthorized(HttpActionContext actionContext) {
              logger.Debug("Memzuc.Net.Authorization.AuthorizeAttribute.IsAuthorized called");
              return base.IsAuthorized(actionContext);
          }
  
          public override void OnAuthorization(HttpActionContext actionContext) {
              logger.Debug("Memzuc.Net.Authorization.AuthorizeAttribute.OnAuthorization called");
              base.OnAuthorization(actionContext);
          }
      }
  }
  </code></pre>
  
  <p>Sure I shall do some other useful things! And I use this attribute like so:</p>
  
  <pre><code>using System.Web.Http;
  using MemAuth = Memzuc.Net.Authorization;
  
  namespace Memzuc.Net.Controllers {
      [RoutePrefix("main-risk")]
      public class MainRiskController : ApiController {
          [Route("")]
          [MemAuth.Authorize]
          public IEnumerable&lt;MainRisk&gt; Get() {
              var repo = GetMainRiskRepo();
              return repo.GetMainRiskList();
          }
  </code></pre>
  
  <p>I see ctor records in the log when the application begins. But both <code>IsAuhorized()</code> and <code>OnAuthorization()</code> are not get called and <code>MainRiskController.Get()</code> method is entered without any authorization control.</p>
  
  <p>Am I doing something wrong? Or is it necessary to register the new authorization attribute to somewhere?</p>