title: Custom IAuthenticationFilter and AllowAnonymous in Web API
body: <p>I would like to make use of <code>AllowAnonymous</code> and a custom <code>AuthenticationFilter</code>. Can someone point me in the right direction to make use of <code>AllowAnonymous</code> or another alternative? Thanks </p>
  
  <p>I've created my own custom filter that inherits from <code>System.Attribute</code> and implements <code>System.Web.Http.Filters.IAuthenticationFilter</code> </p>
  
  <pre class="lang-cs prettyprint-override"><code> public class MyCustomAuthenticationAttribute : Attribute, IAuthenticationFilter
  </code></pre>
  
  <p>I have been able to successfully add the logic for the <code>AuthenticateAsync</code> method </p>
  
  <pre class="lang-cs prettyprint-override"><code> public async Task AuthenticateAsync(
       HttpAuthenticationContext context, 
       CancellationToken cancellationToken) {}
  </code></pre>
  
  <p>My problem is that I need to ignore some of my Web API controller actions or controllers. I thought that I could use <code>System.Web.Http.AllowAnonymousAttribute</code> to do this. For example here is a really simple example showing intent. </p>
  
  <pre class="lang-cs prettyprint-override"><code>[MyCustomAuthentication]
  public class HomeController : ApiController
  {
      // no authentication needed allow anonymous 
      [HttpGet]
      [Route("hianonymous")]
      [AllowAnonymous]
      public IHttpActionResult Hello(string name) {
          return Ok(new { message = "hello " + name }); 
      }
  
      // needs to be authenticated 
      [HttpGet] 
      [Route("hiauthenticated")]
      public IHttpActionResult Hello() {
          var name = User.Identity.Name;
          return Ok(new { message = "hello authenticated user " + name });  
      }
  }
  </code></pre>
  
  <p>The problem is that <code>Authenticate()</code> is still called on <code>MyCustomAuthenticationAttribute</code>. I would like to use <code>AllowAnonymous</code> or some other method to accomplish this. Thanks for any input. </p>
  
  <p>I know that I can use my custom authentication attribute at the action level and not controller level but there are cases I would like an entire controller or even as a global filter so I need to be able to excluded on an individual action or controller basis. </p>