title: Custom AuthorizeAttribute with custom authentication
body: <p>I am using ASP.NET MVC 4 Web application as a front-end for some WCF services. 
  All the user log in/log out and session control is done on the back-end. MVC app should only store a single cookie with session ID. My client does not allow to use Forms Authentication, everything must be customized.</p>
  
  <p>I have set up the following in my web.config:</p>
  
  <pre><code>  &lt;system.web&gt;
  ...
      &lt;authentication mode="None" /&gt;
    &lt;/system.web&gt;
  
    &lt;system.webServer&gt;
      &lt;modules&gt;
  ...
        &lt;remove name="FormsAuthentication" /&gt;
  ...    
      &lt;/modules&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>I have also a global filter:</p>
  
  <pre><code>public class FilterConfig
  {
      public static void RegisterGlobalFilters(GlobalFilterCollection filters)
      {
          // Force all actions to request auth. Only actions marked with [AllowAnonymous] will be allowed.
          filters.Add(new MyAuthorizeAttribute());
      }
  }
  </code></pre>
  
  <p>which is called in Global.asax</p>
  
  <pre><code>   FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
  </code></pre>
  
  <p>I have marked with [AllowAnonymous] every controller and action which does not need authorization. </p>
  
  <p>And now I have to implement MyAuthorizeAttribute. I have tried some tutorials, but none of them completely match my scenarios.</p>
  
  <p>Basically, I have to handle the following scenarios for each action:</p>
  
  <ol>
  <li>If there is a valid cookie, the current request should be considered
  authorized (there will be no any roles to check, only one kind of users). </li>
  <li>If there is no cookie, I should
  override the default MVC handler (which tries to load Account/Login)
  and redirect users to Home/Index page with a message that the user
  should log in. </li>
  <li>If the WCF method call throws
  FaultException where our custom SecurityFault says
  that session has expired (SecurityFault has a custom enum field
  which contains the reason of exception), I should destroy my custom
  session cookie and again redirect the user to Home/Index page with a
  message that the user should log in because his last session has
  expired. For all the other SecurityFaults I can let them go through - I
  have a global error handler.</li>
  </ol>
  
  <p>As far as I understand, I need to override AuthorizeCore (to check my cookie to see if the session exists and is still valid) and HandleUnauthorizedRequest (to redirect users to Home/Index instead of default Login page).</p>
  
  <p>For redirection I tried:</p>
  
  <pre><code>    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {            
          base.HandleUnauthorizedRequest(filterContext);
          filterContext.Result = new RedirectResult("/Home/Index/NeedsLogin");
      }
  </code></pre>
  
  <p>which seems to handle the scenario 2nd fine (I'm not sure about that base call, though - is it needed?).</p>
  
  <p>For the 1st scenario, I need to implement AuthorizeCore. I'm not sure, how to do it correctly. I have seen that AuthorizeAttribute has some code for handling caching situations and maybe many more hidden functionality and I don't want to break it.</p>
  
  <p>For the 3rd scenario, I am not sure if MyAuthorizeAttribute will be able to handle it. Can AuthorizeAttribute catch exceptions which occur inside of the Action or I'll have to handle SecurityFault.SessionExpired situations in my global error handler?</p>