After remove a authorize attribute on you method in a controller like [Authorize] or even a manual authorization attribute like this [BasicAuthentication] that you created (expect you handle it), you have to put this attribute [AllowAnonymous] on you method name.