I've read that to use the attribute `[Authorize]` on MVC, you just have to place it over an action or over the controller class you want to secure.

My question is: How does the `Authorize` attribute know if a user is logged or not? Do i have to provide any Session object in order to let `Authorize` know if a user is authorized?