title: Custom Authorization Attribute Not Always Working
body: <p>I have taken code from a previous custom Authorization attribute and come up with this:</p>
  
  <pre><code>    public class PortalAuthorizeAttribute : AuthorizeAttribute
  {
      private WebSiteSession m_UserSession;
      protected WebSiteSession myUserSession
      {
          get
          {
              if (m_UserSession == null)
                  try { m_UserSession = (WebSiteSession)HttpContext.Current.Session["UserSession"]; }
                  catch
                  {
                      m_UserSession = new WebSiteSession();
                      HttpContext.Current.Session["UserSession"] = m_UserSession;
                  }
              return m_UserSession;
          }
      }
  
      public override void OnAuthorization(AuthorizationContext filterContext)
      {
          if (filterContext.Result is HttpUnauthorizedResult || myUserSession == null || !myUserSession.IsAuthenticated || myUserSession.AdvertiserId == 0)
          {
              filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary
              {
                      { "client", filterContext.RouteData.Values["client"] },
                      { "controller", "Account" },
                      { "action", "Login" },
                      { "returnUrl", filterContext.HttpContext.Request.RawUrl }
              });
          }
      }
  }
  </code></pre>
  
  <p>I am working from within a larger project so we get our session from a higher namespace. The issue it will redirect fine if I am logged out or if I do not have authorization (redirect to the area login page) but it seems if I idle (session times out??) it will still act like I am authorized but will not have any credentials attached to the session. So it still thinks I am validly logged in but I am not. Am I forgetting something in my filter check? The cookie is no longer valid but its like the user is still able to access the page.</p>
  
  <p>Thanks</p>