asp.net web api - How to customize the System.Web.Http.AuthorizeAttribute with Microsoft.Owin.Security? -

i've implemented custom authorizeattribute in webapi (note different mvc authorizeattribute).

i've overridden onauthorization method. in method check if user authenticated. if not authenticated, challenge user login.

part of custom logic check authenticated users if authorized continue (basically check name/email. if exists in predefined list, have access).

the issue see this: after user authenticates fails authorized, see there infinite loop redirection login page.

again, challenege user credentials in onauthorization method. might causing infinite looping, , how prevent once user has been determined have no authorization?

* updated snippet *

public override void onauthorization(system.web.http.controllers.httpactioncontext actioncontext) {     base.onauthorization(actioncontext); // should here?      var owincontext = httpcontext.current.getowincontext();     var authenticated = owincontext.authentication.user.identity.isauthenticated;     var request = system.web.httpcontext.current.request;      if (!authenticated)     {             // challenge user crednetials         if (!request.isauthenticated)         {             // user requested login.             owincontext.authentication.challenge(                 new authenticationproperties { redirecturi = "/" },                 wsfederationauthenticationdefaults.authenticationtype);         }     }     else     {         // @ point user ia authenticated.         // lets check if user authorized application.         var isauthorized = securityhelper.isuserauthorized();         if (isauthorized)         {             // authorized.             return;         }          // not authorized.         actioncontext.response = new system.net.http.httpresponsemessage(system.net.httpstatuscode.unauthorized);     } } 

you try removing onauthorization , adding this:

protected override bool isauthorized(httpactioncontext actioncontext) {     var owincontext = httpcontext.current.getowincontext();     var authenticated = owincontext.authentication.user.identity.isauthenticated;      return authenticated & securityhelper.isuserauthorized();  } 

i don't why you're redirecting on failed authentication, surely api should return 401?