c# - WebAPI [Authorize] attribute. What is happening here? -

i'm working on building webapi accountcontroller basic account functionality login, logout, register, etc.

the top of controller decorated [system.web.http.authorize] attribute.

in following method, user authenticated local system user unless decorate method "allowanonymous":

    // get/api/isauthenticated     // [system.web.http.allowanonymous]     [system.web.http.httpget]     public httpresponsemessage isauthenticated()     {         if (user.identity.isauthenticated)         {             var userprofile = _service.getuserprofile(websecurity.currentuserid);             return request.createresponse(httpstatuscode.ok, userprofile);         }         else         {             return request.createresponse(httpstatuscode.ok, false);         }     } 

from understand, allowanonymous tells controller not apply authorize attribute given method. since i'm building web application, never want authorize against local credentials.

i pulled code mvc spa template i'm wondering - how can changed authorize against locally stored user credentials, instead of system user, when [allowanonymous] isn't used?

when using webapi should authenticate users via http basic authorization, http standard authorization. if logging via aspx page should set authorization in config section forms authentication , if not, should add http authorization headers in webapi calls.

webapi controller different normal controller , authentication mechanisms.