Token authorization without identity - asp.net-web-api

Question

I am planning to use the codes below for my web api security but i am not sure that is enough safe and logical way. I don't want to use OWIN and AspNet.Identity because it's very complicated for me and i don't understand completely and I don't know how i customize db tables, user roles etc. But my way is simple and very customizable for me.
This is CustomAuthorizeAttribute;
public class CustomAuthorize : AuthorizeAttribute
{
public override void OnAuthorization(HttpActionContext actionContext)
{
if ((actionContext.Request.Headers.GetValues("Host").FirstOrDefault().Contains("localhost:15742")))
{
IEnumerable<string> access_token;
if (actionContext.Request.Headers.TryGetValues("Authorization", out access_token))
{
var user = GetUserByToken(access_token);
if (user!=null && !user.TokenIsExpired)
{
HttpContext.Current.Response.AddHeader("WWW-Authenticate", "Custom " + access_token.FirstOrDefault());
return;
}
else
{
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
HttpContext.Current.Response.AddHeader("WWW-Authenticate", "Custom");
return;
}
}
else
{
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
}
}
else
{
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
}
}
}
And this is front end using
<script type="text/javascript">
$(function () {
var access_token = $.cookie('access_token');
if (access_token == undefined) {
$.cookie('access_token', 'test-token');
}
$.ajax({
url: '/api/account',
headers: { access_token: access_token },
success: function (data) {
document.write(data.name + " " + data.lastname);
}
});
});
</script>
By the way i am sorry about for my English. I hope you understand my problem and i am waiting for your suggestions.

Answer 1

I would suggest you invest time into learning a proper way of doing these things. There is a reason libraries are used and that's to make sure you don't create something which is easy to hack. Security is paramount for such things.
I happen to have an extensive article on this subject and I hope it can help you understand a bit more about this subject. By all means, do your own research as well, find other resources, look into using Claims for example, but don't try to shortcut these things as you'll end up with something not secure at all.
Hopefully this helps : https://eidand.com/2015/03/28/authorization-system-with-owin-web-api-json-web-tokens/