title: Override AuthorizeAttribute in ASP.Net Core and respond Json status
body: <p>I'm moving from ASP.Net Framework to ASP.Net Core.</p>
  
  <p>In ASP.Net Framework with Web API 2 project, I can customize AuthorizeAttribute like this :</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class ApiAuthorizeAttribute : AuthorizationFilterAttribute
  {
      #region Methods
  
      /// &lt;summary&gt;
      ///     Override authorization event to do custom authorization.
      /// &lt;/summary&gt;
      /// &lt;param name="httpActionContext"&gt;&lt;/param&gt;
      public override void OnAuthorization(HttpActionContext httpActionContext)
      {
          // Retrieve email and password.
          var accountEmail =
              httpActionContext.Request.Headers.Where(
                      x =&gt;
                          !string.IsNullOrEmpty(x.Key) &amp;&amp;
                          x.Key.Equals("Email"))
                  .Select(x =&gt; x.Value.FirstOrDefault())
                  .FirstOrDefault();
  
          // Retrieve account password.
          var accountPassword =
              httpActionContext.Request.Headers.Where(
                      x =&gt;
                          !string.IsNullOrEmpty(x.Key) &amp;&amp;
                          x.Key.Equals("Password"))
                  .Select(x =&gt; x.Value.FirstOrDefault()).FirstOrDefault();
  
          // Account view model construction.
          var filterAccountViewModel = new FilterAccountViewModel();
          filterAccountViewModel.Email = accountEmail;
          filterAccountViewModel.Password = accountPassword;
          filterAccountViewModel.EmailComparision = TextComparision.Equal;
          filterAccountViewModel.PasswordComparision = TextComparision.Equal;
  
          // Find the account.
          var account = RepositoryAccount.FindAccount(filterAccountViewModel);
  
          // Account is not found.
          if (account == null)
          {
              // Treat the account as unthorized.
              httpActionContext.Response = httpActionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
  
              return;
          }
  
          // Role is not defined which means the request is allowed.
          if (_roles == null)
              return;
  
          // Role is not allowed 
          if (!_roles.Any(x =&gt; x == account.Role))
          {
              // Treat the account as unthorized.
              httpActionContext.Response = httpActionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
  
              return;
          }
  
          // Store the requester information in action argument.
          httpActionContext.ActionArguments["Account"] = account;
      }
  
      #endregion
  
      #region Properties
  
      /// &lt;summary&gt;
      ///     Repository which provides function to access account database.
      /// &lt;/summary&gt;
      public IRepositoryAccount RepositoryAccount { get; set; }
  
      /// &lt;summary&gt;
      ///     Which role can be allowed to access server.
      /// &lt;/summary&gt;
      private readonly byte[] _roles;
  
      #endregion
  
      #region Constructor
  
      /// &lt;summary&gt;
      ///     Initialize instance with default settings.
      /// &lt;/summary&gt;
      public ApiAuthorizeAttribute()
      {
      }
  
      /// &lt;summary&gt;
      ///     Initialize instance with allowed role.
      /// &lt;/summary&gt;
      /// &lt;param name="roles"&gt;&lt;/param&gt;
      public ApiAuthorizeAttribute(byte[] roles)
      {
          _roles = roles;
      }
  
      #endregion
  }
  </code></pre>
  
  <p>In my customized AuthorizeAttribute, I can check whether account is valid or not and return HttpStatusCode with message to client. </p>
  
  <p>I'm trying to do the samething in ASP.Net Core, but no OnAuthorization for me to override. </p>
  
  <p>How can I achieve the same thing as in ASP.Net Framework ?</p>
  
  <p>Thank you,</p>