title: Custom Authorize Attribute
body: <p>I'm building my own membership system and I want nothing to do with the MS Membership provider. I've looked around the internet and here on StackOverflow but all I could found was membership providers built on top of the MS Membership provider.</p>
  
  <p>Anyway, I've got almost everything hooked up now, but I'd like to use a custom Authorize attribute which utilized my membership infrastructure. I checked out <a href="https://stackoverflow.com/questions/4664302/mvc-roleprovider-and-authorize-attribute">this</a> thread here on the site and I'm trying to do something similar, but I'm not sure that's quiet what I need. So far these are the classes I've got:</p>
  
  <p><strong>SessionManager:</strong></p>
  
  <pre><code>public static class SessionManager : ISessionManager
  {
      public static void RegisterSession(string key, object obj)
      {
          System.Web.HttpContext.Current.Session[key] = obj;
      }
  
      public static void FreeSession(string key)
      {
          System.Web.HttpContext.Current.Session[key] = null;
      }
  
  
      public static bool CheckSession(string key)
      {
          if (System.Web.HttpContext.Current.Session[key] != null)
              return true;
          else
              return false;
      }
  
  
      public static object ReturnSessionObject(string key)
      {
          if (CheckSession(key))
              return System.Web.HttpContext.Current.Session[key];
          else
              return null;
      }
  }
  </code></pre>
  
  <p><strong>SharweAuthorizeAttribute:</strong> (<em>I am not really sure if that's actually what I should be doing</em>)</p>
  
  <pre><code>public class SharweAuthorizeAttribute : AuthorizeAttribute
  {
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          if (SessionManager.CheckSession(SessionKeys.User) == true)
              return true;
          else 
              return false;
      }
  }
  </code></pre>
  
  <p>Now here's what I need:</p>
  
  <ol>
  <li>Is my SharweAuthorizeAttribute class
  correct in the first place?</li>
  <li>I need to be able to redirect
  unauthenticated users to the login
  page</li>
  <li><p>I need to authorize users based on
  their roles (using my own role
  provider) so I would do something
  like:</p>
  
  <pre><code>[SharweAuthorize(Roles="MyRole")]
  </code></pre></li>
  </ol>
  
  <p>That's it I guess... Any suggestions are more than welcome :)</p>
  
  <p><strong>UPDATE:</strong>
  Ok I just read that page again and found the solution to question number two:</p>
  
  <pre><code>protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
  {
      if (SessionManager.CheckSession(SessionKeys.User) == false)
      {
          filterContext.Result = new RedirectToRouteResult(
                          new RouteValueDictionary 
                          {
                              { "action", "ActionName" },
                              { "controller", "ControllerName" }
                          });
      }
      else
          base.HandleUnauthorizedRequest(filterContext);
  }
  </code></pre>
  
  <p>Let me know if I got it right please...</p>