I have the following controller with a custom authorize attribute:

```
[CustomAuthorize(Roles = "Editor, Admin")]
public ActionResult Test()
{
       //...

}

```

Here is my custom authorize code:

```
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class CustomAuthorizeAttribute : AuthorizeAttribute
{

    private readonly string[] _allowedRoles;

    public CustomAuthorizeAttribute(params string[] roles)
    {
        _allowedRoles = roles;

    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (httpContext == null)
            throw new ArgumentNullException("httpContext");

        var user = httpContext.User;

        if (!user.Identity.IsAuthenticated)
        {
            return false;
        }

        if (_allowedRoles.Length > 0 && !_allowedRoles.Any(user.IsInRole))
        {
            return false;
        }

        return true;

    }

}

```

The custom authorize is returning **true** for **even a user who is not an Editor or Admin**?

I think the issue is this:

```
[CustomAuthorize(Roles = "Editor, Admin")]

```

I'm passing it as a string and I need to convert it to an array in my CustomAuthorize method???