System.Web.Http.Authorize vs System.Web.Mvc.Authorize

You must use System.Web.Http.Authorize against an ApiController (Web API controller) and System.Web.Mvc.Authorize against a Controller (MVC controller).

Thanks to: Badri
Source: http://stackoverflow.com/a/19156530/1931848