How to use authorize attribute on MVC3

asp.net-mvc-3

Solution

This attribute works by looking at `HttpContext.User.Identity.IsAuthenticated`.

If you're using something like FormsAuthentication, this will be set to true if the user has a valid FormsAuthentication cookie on their machine (which you can add by using `FormsAuthentication.SetAuthCookie`).

If you're interested in the inner-workings of `Authorize`, this is from the published Microsoft source code:

protected virtual bool AuthorizeCore(HttpContextBase httpContext) {
        if (httpContext == null) {
            throw new ArgumentNullException("httpContext");
        } 

        IPrincipal user = httpContext.User; 
        if (!user.Identity.IsAuthenticated) { 
            return false;
        } 

        if (_usersSplit.Length > 0 && !_usersSplit.Contains(user.Identity.Name, StringComparer.OrdinalIgnoreCase)) {
            return false;
        } 

        if (_rolesSplit.Length > 0 && !_rolesSplit.Any(user.IsInRole)) { 
            return false; 
        }

        return true;
    }

Here is some more info on FormsAuthentication.

Problem

I've read that to use the attribute `[Authorize]` on MVC, you just have to place it over an action or over the controller class you want to secure. My question is: How does the `Authorize` attribute know if a user is logged or not? Do i have to provide any Session object in order to let `Authorize` know if a user is authorized?

Original source