Cannot Cause Custom AuthorizeAttribute to be Called - authorize-attribute

Question

The authentication works. All good there, not worried about that, I get a 401 if I don't send a proper token.
What I want to do is control REST API methods by user. So I am given to understand the way to do that is to put an attribute on the method that is derived from AuthorizeAttribute.
I am trying to achieve a dirt-simple way of denying access to the MakeComplexNote method.
The problem is that the code in the attribute is never called. Ever. Except the constructor.
I'm not concerned about the merits of what I am trying to do. I just want to know the mechanics. I am tired of fighting with this. How do I do it with the least amount of code possible?
Here is my controller:
using FleetApi.AuthProvider;
using System.Web.Http;
namespace FleetApi.Controllers
{
public class MakeSimpleNoteRequest
{
public string Content { get; set; }
}
public class MakeSimpleNoteResponse
{
public string FinalNote { get; set; }
}
[Authorize]
[RoutePrefix("api/notes")]
public class NotesController : ApiController
{
[HttpPost]
[Route(nameof(MakeSimpleNote))]
public MakeSimpleNoteResponse MakeSimpleNote([FromBody] MakeSimpleNoteRequest request)
{
return new MakeSimpleNoteResponse()
{
FinalNote = request?.Content?.ToUpper(),
};
}
[HttpPost]
[Route(nameof(MakeComplexNote))]
[FleetAuthorize]
public MakeSimpleNoteResponse MakeComplexNote([FromBody] MakeSimpleNoteRequest request)
{
return new MakeSimpleNoteResponse()
{
FinalNote = "COMPLEX:" + (request?.Content?.ToUpper()),
};
}
}
}
And here is the custom attribute
using System;
using System.Web;
using System.Web.Mvc;
namespace FleetApi.AuthProvider
{
[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = false)]
public class FleetAuthorizeAttribute : AuthorizeAttribute
{
public FleetAuthorizeAttribute()
{
}
public override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
}
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
return false;
}
}
}

Answer 1

I think I finally found the answer. I needed to use
using System.Web.Http;
instead of
using System.Web.Mvc;
to get the base class for my attribute
using System;
using System.Linq;
using System.Net.Http;
using System.Security.Claims;
using System.Web.Http;
using System.Web.Http.Controllers;
namespace FleetApi.AuthProvider
{
[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = false)]
public class FleetAuthorizeAttribute : AuthorizeAttribute
{
public FleetAuthorizeAttribute()
{
}
protected override bool IsAuthorized(HttpActionContext actionContext)
{
return false;
}
protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
{
actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Forbidden);
actionContext.Response.Content = new StringContent("{}");
}
}
}