title: Custom Authorize Attribute (follow-up)
body: <p>Ok following up with <a href="https://stackoverflow.com/questions/5070339/custom-authorize-attribute">this thread</a>, here's what I came up with... </p>
  
  <pre><code>public class SharweAuthorizeAttribute : AuthorizeAttribute
  {
      private bool isAuthenticated = false;
      private bool isAuthorized = false;
      public new string[] Roles { get; set; }
  
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          if (SessionManager.CheckSession(SessionKeys.User) == true)
          {
              isAuthenticated = true;
              foreach (string role in Roles)
              {
                  if (RolesService.HasRole((string)role))
                      isAuthorized = true;
              }
          }
          return (isAuthenticated &amp;&amp; isAuthorized);
      }
  
      protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {
          if (!isAuthenticated)
          {
              filterContext.Result = new RedirectToRouteResult(
                              new RouteValueDictionary 
                              {
                                  { "action", "User" },
                                  { "controller", "Login" }
                              });
          } else if(!isAuthorized) {
              filterContext.Result = new RedirectToRouteResult(
                              new RouteValueDictionary 
                              {
                                  { "action", "Home" },
                                  { "controller", "Error" }
                              });
          }
      }
  }
  </code></pre>
  
  <p>How/why I came up with this? Because I believe the AuthorizeAttribute workflow goes as follows:</p>
  
  <ol>
  <li>First, AuthorizeCore is triggered. If it returns true, the user is authorized. If it returns false, HandleUnauthorizedRequest is triggered. Is that right?</li>
  <li>I read somewhere that I need to use the <code>new</code> keyword to override a property. Therefore, this is how I overrode the Roles property. But what if the overriding property was of a different type of the initial one (the one in the base class), does that also hide it or creates a totally different property?</li>
  </ol>
  
  <p>So what do you think? Should that actually work? I cannot test it now because I haven't set up the UI (waiting for the designer to get done with the design)... In fact, this is the first time I appreciate the benefits of TDD, I used to think it's utterly stupid and useless, but I was wrong :)</p>
  
  <p>P.S: On <a href="https://stackoverflow.com/questions/977071/redirecting-unauthorized-controller-in-asp-net-mvc">this thread</a>, @tvanfosson is setting the CachePolicy of the context (I think), could someone explain that and why I might need to do that please? </p>
  
  <p>Thanks in advance.</p>