HttpModule Web Api

Question

I am trying to get auth basic on my web api. I wrote a simple HttpModule to check it out

public class BasicAuth : IHttpModule
{
    SqlConnection con = new SqlConnection(WebConfigurationManager.ConnectionStrings["Connection"].ConnectionString);
    private const string Realm = "MyRealm";

    public void Init(HttpApplication context)
    {
        // Register event handlers
        context.AuthorizeRequest += new EventHandler(OnApplicationAuthenticateRequest);
        context.EndRequest += new EventHandler(OnApplicationEndRequest);
    }

    private static void SetPrincipal(IPrincipal principal)
    {
        Thread.CurrentPrincipal = principal;
        if (HttpContext.Current != null)
        {
            HttpContext.Current.User = principal;
        }
    }

    private bool CheckPassword(string username, string password)
    {
        var parameters = new DynamicParameters();
        parameters.Add("@UserName", username);
        parameters.Add("@Password", password);
        con.Open();
        try
        {
            var query = //query to db to check username and password
            return query.Count() == 1 ? true : false;
        }
        catch
        {
            return false;
        }
        finally
        {
            con.Close();
        }
    }

    private bool AuthenticateUser(string credentials)
    {
        try
        {
            var encoding = Encoding.GetEncoding("iso-8859-1");
            credentials = encoding.GetString(Convert.FromBase64String(credentials));

            int separator = credentials.IndexOf(':');
            string name = credentials.Substring(0, separator);
            string password = credentials.Substring(separator + 1);

            if (CheckPassword(name, password))
            {
                var identity = new GenericIdentity(name);
                SetPrincipal(new GenericPrincipal(identity, null));

                return true;
            }
            else
            {
                return false;
            }
        }
        catch
        {
            return false;
        }
    }

    private void OnApplicationAuthenticateRequest(object sender, EventArgs e)
    {
        var authHeader = request.Headers["Authorization"];
        if (authHeader != null)
        {
            var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);

            // RFC 2617 sec 1.2, "scheme" name is case-insensitive
            if (authHeaderVal.Scheme.Equals("basic",
                    StringComparison.OrdinalIgnoreCase) &&
                authHeaderVal.Parameter != null)
            {
                if (AuthenticateUser(authHeaderVal.Parameter))
                {
                    //user is authenticated
                }
                else
                {
                    HttpContext.Current.Response.StatusCode = 401;
                }
            }
            else
            {
                HttpContext.Current.Response.StatusCode = 401;
            }
        }
        catch
        {
            HttpContext.Current.Response.StatusCode = 401;
        }
    }

    private static void OnApplicationEndRequest(object sender, EventArgs e)
    {
        var response = HttpContext.Current.Response;
        if (response.StatusCode == 401)
        {
            response.Headers.Add("WWW-Authenticate",
                string.Format("Basic realm=\"{0}\"", Realm));
        }
    }

    public void Dispose()
    {
    }
}

well, this code works very well, except that it asks for basic auth even on the controller. I do not put the [Authorize] tag. And when this happens, it returns the necessary data.

Let me explain:

My HistoryController has a [Authorize] attribute to execute a POST request, I have to send an auth header to get the data, if I do not, I get a 401 status code and a user error.

My HomeController [Authorize], , , "", . ( 401, ).

?