public override void OnAuthorization(HttpActionContext actionContext) { // try to authorize as device try { var authorizeDeviceAttribute = new AuthorizeDeviceAttribute(); authorizeDeviceAttribute.OnAuthorization(actionContext); return; } catch (HttpResponseException) { } // try to authorize as user var authorizeUserAttribute = new AuthorizeUserAttribute { Roles = Roles }; authorizeUserAttribute.OnAuthorization(actionContext); return; }