protected override bool IsAuthorized(HttpActionContext actionContext) { var roleManager = ApplicationRoleManager.GetExist(); var roles = roleManager.Roles; var role = HttpContext.Current.User.IsInRole("User"); return(role); }