title: How Authorize attribute work in MVC3
body: <p>I research about mvc3 and i read alot article or watch video on asp.net website.
  After i have some knowledge about mvc3 and so i have question about <strong>Authorize</strong> attribute to authenticate user is login or not.
  The default code when i create a page to authenticate user like this:</p>
  
  <pre><code>[HttpPost]
      public ActionResult LogOn(LogOnModel model, string returnUrl)
      {
          if (ModelState.IsValid)
          {
              if (Membership.ValidateUser(model.UserName, model.Password))
              {
                  FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                  if (Url.IsLocalUrl(returnUrl) &amp;&amp; returnUrl.Length &gt; 1 &amp;&amp; returnUrl.StartsWith("/")
                      &amp;&amp; !returnUrl.StartsWith("//") &amp;&amp; !returnUrl.StartsWith("/\\"))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                  {
                      return RedirectToAction("Index", "Home");
                  }
              }
              else
              {
                  ModelState.AddModelError("", "The user name or password provided is incorrect.");
              }
          }
  
          // If we got this far, something failed, redisplay form
          return View(model);
      }
  </code></pre>
  
  <p>If i don't want to use Membership and FormsAuthentication (Don't say about windows authentication) to authorize for user.  So is there any way to create something to authenticate user and when i use <strong>Authorize</strong>
   attribute it will work like when i use <strong>Membership and FormsAuthentication</strong>. I don't know what Authorize attribute use to authenticate user is login or not, from that i can create a session or cookie by myself to authenticate user.  If my question not clear , please let me know!
  Thanks for reading!</p>