Home/ Questions/Q 8604801
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T02:40:07+00:00

I’ve seen plenty of guides where implementation of custom authorization filter involves calling base.OnAuthorization(filterContext)

  • 0

I’ve seen plenty of guides where implementation of custom authorization filter involves calling base.OnAuthorization(filterContext) as final step. I have my own custom authorization filter and it works perfectly without above mentioned. However, when I add call to base.OnAuthorization(filterContext), my WebAPI service returns 401, even though all checks passed successfully.

1) Why do I have to call base.OnAuthorization?
2) How come it returns 401 on it’s own?

EDIT: I’m thinking it has to do with default Membership and Role providers. Since I’m sort of skipping those, could that be the reason?

As soon as I call base.OnAuthorization, my Response becomes 401.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You don’t have to call that if you handle everything yourself.

    But if you do, authorization logic will pull the user (IPrincipal.Identity) out of Thread.CurrentPrincipal and will deny authorization (401) if one of the following conditions is met:

    • IPrincipal is null

    • IPrincipal.Identity is not authenticated

    • IPrincipal.Identity is authenticated but is not in the authorized
      group of users, or if the user is not in any of the authorized roles
      (specified on the attribute)

    • 0