diff --git a/src/ApiGateways/Mobile.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs b/src/ApiGateways/Mobile.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
index b3a7246aa..865fd1906 100644
--- a/src/ApiGateways/Mobile.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/ApiGateways/Mobile.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
@@ -1,33 +1,37 @@
 namespace Microsoft.eShopOnContainers.Mobile.Shopping.HttpAggregator.Filters
 {
-    using Microsoft.AspNetCore.Authorization;
-    using Swashbuckle.AspNetCore.Swagger;
-    using Swashbuckle.AspNetCore.SwaggerGen;
-    using System.Collections.Generic;
-    using System.Linq;
+	using Microsoft.AspNetCore.Authorization;
+	using Swashbuckle.AspNetCore.Swagger;
+	using Swashbuckle.AspNetCore.SwaggerGen;
+	using System.Collections.Generic;
+	using System.Linq;
 
-    namespace Basket.API.Infrastructure.Filters
-    {
-        public class AuthorizeCheckOperationFilter : IOperationFilter
-        {
-            public void Apply(Operation operation, OperationFilterContext context)
-            {
-                // Check for authorize attribute
-                var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                                   context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	namespace Basket.API.Infrastructure.Filters
+	{
+		public class AuthorizeCheckOperationFilter : IOperationFilter
+		{
+			public void Apply(Operation operation, OperationFilterContext context)
+			{
+				// Check for authorize attribute
 
-                if (hasAuthorize)
-                {
-                    operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                    operation.Responses.Add("403", new Response { Description = "Forbidden" });
+				var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+									 .Union(context.MethodInfo.GetCustomAttributes(true))
+									 .OfType<AuthorizeAttribute>().Any();
 
-                    operation.Security = new List<IDictionary<string, IEnumerable<string>>>();
-                    operation.Security.Add(new Dictionary<string, IEnumerable<string>>
-                {
-                    { "oauth2", new [] { "Microsoft.eShopOnContainers.Mobile.Shopping.HttpAggregator" } }
-                });
-                }
-            }
-        }
-    }
+				if (hasAuthorize)
+				{
+					operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+					operation.Responses.Add("403", new Response { Description = "Forbidden" });
+
+					operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+					{
+						new Dictionary<string, IEnumerable<string>>
+						{
+							{ "oauth2", new [] { "Microsoft.eShopOnContainers.Mobile.Shopping.HttpAggregator" } }
+						}
+					};
+				}
+			}
+		}
+	}
 }
diff --git a/src/ApiGateways/Web.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs b/src/ApiGateways/Web.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
index 3f382e5df..0956ee3ac 100644
--- a/src/ApiGateways/Web.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/ApiGateways/Web.Bff.Shopping/aggregator/Filters/AuthorizeCheckOperationFilter.cs
@@ -1,33 +1,37 @@
 namespace Microsoft.eShopOnContainers.Web.Shopping.HttpAggregator.Filters
 {
-    using Microsoft.AspNetCore.Authorization;
-    using Swashbuckle.AspNetCore.Swagger;
-    using Swashbuckle.AspNetCore.SwaggerGen;
-    using System.Collections.Generic;
-    using System.Linq;
+	using Microsoft.AspNetCore.Authorization;
+	using Swashbuckle.AspNetCore.Swagger;
+	using Swashbuckle.AspNetCore.SwaggerGen;
+	using System.Collections.Generic;
+	using System.Linq;
 
-    namespace Basket.API.Infrastructure.Filters
-    {
-        public class AuthorizeCheckOperationFilter : IOperationFilter
-        {
-            public void Apply(Operation operation, OperationFilterContext context)
-            {
-                // Check for authorize attribute
-                var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                                   context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	namespace Basket.API.Infrastructure.Filters
+	{
+		public class AuthorizeCheckOperationFilter : IOperationFilter
+		{
+			public void Apply(Operation operation, OperationFilterContext context)
+			{
+				// Check for authorize attribute
 
-                if (hasAuthorize)
-                {
-                    operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                    operation.Responses.Add("403", new Response { Description = "Forbidden" });
+				var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+					                     .Union(context.MethodInfo.GetCustomAttributes(true))
+									 .OfType<AuthorizeAttribute>().Any();
 
-                    operation.Security = new List<IDictionary<string, IEnumerable<string>>>();
-                    operation.Security.Add(new Dictionary<string, IEnumerable<string>>
-                {
-                    { "oauth2", new [] { "Microsoft.eShopOnContainers.Web.Shopping.HttpAggregator" } }
-                });
-                }
-            }
-        }
-    }
+				if (hasAuthorize)
+				{
+					operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+					operation.Responses.Add("403", new Response { Description = "Forbidden" });
+
+					operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+					{
+						new Dictionary<string, IEnumerable<string>>
+						{
+							{ "oauth2", new [] { "Microsoft.eShopOnContainers.Web.Shopping.HttpAggregator" } }
+						}
+					};
+				}
+			}
+		}
+	}
 }
diff --git a/src/Services/Basket/Basket.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs b/src/Services/Basket/Basket.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
index f1c7b08d0..c14c035e3 100644
--- a/src/Services/Basket/Basket.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/Services/Basket/Basket.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
@@ -10,9 +10,10 @@ namespace Basket.API.Infrastructure.Filters
     {
         public void Apply(Operation operation, OperationFilterContext context)
         {
-            // Check for authorize attribute
-            var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                               context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+			// Check for authorize attribute
+			var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+				                     .Union(context.MethodInfo.GetCustomAttributes(true))
+								 .OfType<AuthorizeAttribute>().Any();
 
             if (hasAuthorize)
             {
diff --git a/src/Services/Location/Locations.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs b/src/Services/Location/Locations.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
index 8eccc83cf..3571d44cb 100644
--- a/src/Services/Location/Locations.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/Services/Location/Locations.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
@@ -7,25 +7,28 @@ using System.Linq;
 
 namespace Microsoft.eShopOnContainers.Services.Locations.API.Infrastructure.Filters
 {
-    internal class AuthorizeCheckOperationFilter : IOperationFilter
-    {
-        public void Apply(Operation operation, OperationFilterContext context)
-        {
-            // Check for authorize attribute
-            var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                               context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	internal class AuthorizeCheckOperationFilter : IOperationFilter
+	{
+		public void Apply(Operation operation, OperationFilterContext context)
+		{
+			// Check for authorize attribute
+			var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+				                     .Union(context.MethodInfo.GetCustomAttributes(true))
+								 .OfType<AuthorizeAttribute>().Any();
 
-            if (hasAuthorize)
-            {
-                operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                operation.Responses.Add("403", new Response { Description = "Forbidden" });
+			if (hasAuthorize)
+			{
+				operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+				operation.Responses.Add("403", new Response { Description = "Forbidden" });
 
-                operation.Security = new List<IDictionary<string, IEnumerable<string>>>();
-                operation.Security.Add(new Dictionary<string, IEnumerable<string>>
-                {
-                    { "oauth2", new [] { "locationsapi" } }
-                });
-            }
-        }
-    }
+				operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+				{
+					new Dictionary<string, IEnumerable<string>>
+					{
+						{ "oauth2", new [] { "locationsapi" } }
+					}
+				};
+			}
+		}
+	}
 }
diff --git a/src/Services/Marketing/Marketing.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs b/src/Services/Marketing/Marketing.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
index 2b4e15188..0de432c64 100644
--- a/src/Services/Marketing/Marketing.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/Services/Marketing/Marketing.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
@@ -6,27 +6,28 @@ using System.Linq;
 
 namespace Microsoft.eShopOnContainers.Services.Marketing.API.Infrastructure.Filters
 {
-    public class AuthorizeCheckOperationFilter : IOperationFilter
-    {
-        public void Apply(Operation operation, OperationFilterContext context)
-        {
-            // Check for authorize attribute
-            var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                               context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	public class AuthorizeCheckOperationFilter : IOperationFilter
+	{
+		public void Apply(Operation operation, OperationFilterContext context)
+		{
+			// Check for authorize attribute
+			var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+								 .Union(context.MethodInfo.GetCustomAttributes(true))
+								 .OfType<AuthorizeAttribute>().Any();
 
-            if (hasAuthorize)
-            {
-                operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                operation.Responses.Add("403", new Response { Description = "Forbidden" });
+			if (hasAuthorize)
+			{
+				operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+				operation.Responses.Add("403", new Response { Description = "Forbidden" });
 
-                operation.Security = new List<IDictionary<string, IEnumerable<string>>>
-                {
-                    new Dictionary<string, IEnumerable<string>>
-                    {
-                        { "oauth2", new [] { "marketingapi" } }
-                    }
-                };
-            }
-        }
-    }
+				operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+			 {
+				new Dictionary<string, IEnumerable<string>>
+				{
+				    { "oauth2", new [] { "marketingapi" } }
+				}
+			 };
+			}
+		}
+	}
 }
\ No newline at end of file
diff --git a/src/Services/Ordering/Ordering.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs b/src/Services/Ordering/Ordering.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
index 3b569e0ba..d535640db 100644
--- a/src/Services/Ordering/Ordering.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
+++ b/src/Services/Ordering/Ordering.API/Infrastructure/Filters/AuthorizeCheckOperationFilter.cs
@@ -1,32 +1,34 @@
 using Microsoft.AspNetCore.Authorization;
 using Swashbuckle.AspNetCore.Swagger;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Threading.Tasks;
 
 namespace Ordering.API.Infrastructure.Filters
 {
-    public class AuthorizeCheckOperationFilter : IOperationFilter
-    {
-        public void Apply(Operation operation, OperationFilterContext context)
-        {
-            // Check for authorize attribute
-            var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                               context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	public class AuthorizeCheckOperationFilter : IOperationFilter
+	{
+		public void Apply(Operation operation, OperationFilterContext context)
+		{
+			// Check for authorize attribute
 
-            if (hasAuthorize)
-            {
-                operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                operation.Responses.Add("403", new Response { Description = "Forbidden" });
+			var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+				                     .Union(context.MethodInfo.GetCustomAttributes(true))
+								 .OfType<AuthorizeAttribute>().Any();
 
-                operation.Security = new List<IDictionary<string, IEnumerable<string>>>();
-                operation.Security.Add(new Dictionary<string, IEnumerable<string>>
-                {
-                    { "oauth2", new [] { "orderingapi" } }
-                });
-            }
-        }
-    }
+			if (hasAuthorize)
+			{
+				operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+				operation.Responses.Add("403", new Response { Description = "Forbidden" });
+
+				operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+				{
+					new Dictionary<string, IEnumerable<string>>
+					{
+						{ "oauth2", new [] { "orderingapi" } }
+					}
+				};
+			}
+		}
+	}
 }
\ No newline at end of file
diff --git a/src/Services/Webhooks/Webhooks.API/Infrastructure/AuthorizeCheckOperationFilter.cs b/src/Services/Webhooks/Webhooks.API/Infrastructure/AuthorizeCheckOperationFilter.cs
index 9de9ee139..6dc40e383 100644
--- a/src/Services/Webhooks/Webhooks.API/Infrastructure/AuthorizeCheckOperationFilter.cs
+++ b/src/Services/Webhooks/Webhooks.API/Infrastructure/AuthorizeCheckOperationFilter.cs
@@ -1,32 +1,34 @@
 using Microsoft.AspNetCore.Authorization;
 using Swashbuckle.AspNetCore.Swagger;
 using Swashbuckle.AspNetCore.SwaggerGen;
-using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Threading.Tasks;
 
 namespace Webhooks.API.Infrastructure
 {
-    public class AuthorizeCheckOperationFilter : IOperationFilter
-    {
-        public void Apply(Operation operation, OperationFilterContext context)
-        {
-            // Check for authorize attribute
-            var hasAuthorize = context.ApiDescription.ControllerAttributes().OfType<AuthorizeAttribute>().Any() ||
-                               context.ApiDescription.ActionAttributes().OfType<AuthorizeAttribute>().Any();
+	public class AuthorizeCheckOperationFilter : IOperationFilter
+	{
+		public void Apply(Operation operation, OperationFilterContext context)
+		{
+			// Check for authorize attribute
 
-            if (hasAuthorize)
-            {
-                operation.Responses.Add("401", new Response { Description = "Unauthorized" });
-                operation.Responses.Add("403", new Response { Description = "Forbidden" });
+			var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true)
+				                     .Union(context.MethodInfo.GetCustomAttributes(true))
+								 .OfType<AuthorizeAttribute>().Any();
 
-                operation.Security = new List<IDictionary<string, IEnumerable<string>>>();
-                operation.Security.Add(new Dictionary<string, IEnumerable<string>>
-                {
-                    { "oauth2", new [] { "webhooksapi" } }
-                });
-            }
-        }
-    }
+			if (hasAuthorize)
+			{
+				operation.Responses.Add("401", new Response { Description = "Unauthorized" });
+				operation.Responses.Add("403", new Response { Description = "Forbidden" });
+
+				operation.Security = new List<IDictionary<string, IEnumerable<string>>>
+				{
+					new Dictionary<string, IEnumerable<string>>
+					{
+						{ "oauth2", new [] { "webhooksapi" } }
+					}
+				};
+			}
+		}
+	}
 }