title: How does the AuthorizeCore Method work?
body: <p>My question is how does the AuthorizeCore method work?</p>
  
  <p>For example when I wanted to create custom Authorize attribute I found that a lot of programmers use this code</p>
  
  <pre><code>var isAuthorized = base.AuthorizeCore(httpContext);
  if (!isAuthorized)
    {
      return false;
    }
  </code></pre>
  
  <p>and then they write their own code.</p>
  
  <p>So what is the role that this piece of code plays, and does the method checks only for the windows users like the administrator and other created users in the computer management else if we customize it to be used in the form authentication. </p>
  
  <p>Also I found this <a href="https://vivekcek.wordpress.com/2013/06/29/custom-form-authentication-in-mvc-4-with-custom-authorize-attribute-and-session-variable/" rel="noreferrer">code</a> but I do not understand why the developer stored the user in a cookie and session instead of the session only.</p>
  
  <p>In PHP I used to store the user in a session only and check if he exist in the session or not.</p>