title: AllowAnonymous not working with Custom AuthorizationAttribute
body: <p>This has had me stumped for a while.  None of the commonly encountered similar situations seem to apply here apparently.  I've probably missed something obvious but I can't see it.</p>
  
  <p>In my Mvc Web Application I use the Authorize and AllowAnonymous attributes in such a way that you have to explicitly open up an action as publicly available rather than lock down the secure areas of the site.  I much prefer that approach. I cannot get the same behaviour in my WebAPI however.</p>
  
  <p>I have written a custom Authorization Attribute that inherits from System.Web.Http.AuthorizeAttribute with the following:</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
  public class MyAuthorizationAttribute : System.Web.Http.AuthorizeAttribute
  </code></pre>
  
  <p>I have this registered as a filter:</p>
  
  <pre><code>    public static void RegisterHttpFilters(HttpFilterCollection filters)
      {
          filters.Add(new MyAuthorizationAttribute());
      }
  </code></pre>
  
  <p>This all works as expected, actions are no longer available without credentials.  The problem is that now the following method will not allow the AllowAnonymous attribute to do it's thing:</p>
  
  <pre><code>[System.Web.Http.AllowAnonymous]
  public class HomeController : ApiController
  {
      [GET("/"), System.Web.Http.HttpGet]
      public Link[] Index()
      {
          return new Link[] 
          { 
              new SelfLink(Request.RequestUri.AbsoluteUri, "api-root"),
              new Link(LinkRelConstants.AuthorizationEndpoint, "OAuth/Authorize/", "authenticate"),
              new Link(LinkRelConstants.AuthorizationTokenEndpoint , "OAuth/Tokens/", "auth-token-endpoint")
          };
      }
  }
  </code></pre>
  
  <p>The most common scenario seems to be getting the two Authorize / AllowAnonymous attributes mixed up.  System.Web.Mvc is for web apps and System.Web.Http is for WebAPI (as I understand it anyway).</p>
  
  <p>Both of the Attributes I'm using are from the same namespace - System.Web.Http.  I assumed that this would just inherit the base functionality and allow me to inject the code I need in the OnAuthotize method.</p>
  
  <p>According to the documentation the AllowAnonymous attribute works inside the OnAuthorize method which I call immediately:</p>
  
  <pre><code>    public override void OnAuthorization(HttpActionContext actionContext)
      {
          base.OnAuthorization(actionContext);
  </code></pre>
  
  <p>Any thought's would be really appreciated.</p>
  
  <p>Has anyone encountered this problem before and found the root cause?</p>