title: Custom Authorize attribute using session variables
body: <p>I've got a classic asp website running inside an MVC 4 application.  So to access areas of the classic asp website the user needs to log in using a classic asp login page.  At this point they are authenticated within the system.  Their <code>userid, security level and authentication</code> are stored in the classic asp session variables.</p>
  
  <p>I then have the log in information from the session put into the ASP.Net session using the same variable names.</p>
  
  <p>I'm trying to create a custom Authorize attribute to use the .NET session variables <code>authentication, userid and securitylevel</code> and then check against a database table to check if the user has permissions to access the section of the site.  I want to be able to use this custom attribute in place of <code>[Authorize]</code> to lock down my controllers and views as required.</p>
  
  <p>I'm unsure where to begin here as I'm new to ASP.NET MVC and c#.</p>