授权属性无关地工作

我已将Authorize属性扩展为包含来自cookie的角色 . 调试给出了良好的结果，它相应地返回true或false . 但是，如果我首先使用“Admin”角色登录，然后尝试转到需要User角色的控制器，则Authorize返回false，但控制器仍允许访问 .

protected override bool AuthorizeCore(HttpContextBase httpContext) 
    {


        if (httpContext == null) throw new ArgumentNullException("httpContext"); 

        if (httpContext.User != null)
        {
            if (httpContext.User.Identity.IsAuthenticated)
            {
                if (httpContext.User.Identity is FormsIdentity)
                {
                    FormsIdentity id = httpContext.User.Identity as FormsIdentity;
                    FormsAuthenticationTicket ticket = id.Ticket;
                    string role = ticket.UserData;

                    if (RequiredRole.Contains(role)) return true;
                }
            }
            else 
                return false;

        }
        return false;

    }

Requiredrole是该类的属性 .

[CustomAuthorize(RequiredRole = "Admin", LoginPage = "Club")]
public class UsuarioAdminController : Controller
{

上面的代码，用于需要管理员角色的控制器 .

[CustomAuthorize(RequiredRole = "User", LoginPage = "Club")]
public class HotelController : Controller
{

以上代码为具有用户角色的控制器 . 有人可以看到为什么如果Authorize返回false它允许访问？谢谢

AuthorizeCore属性按预期运行，返回true或false;但是，当AuthorizeCore方法返回false时，控制器允许访问 .

是的，有更多的代码，但我不认为它有所不同......它就是这样 .

public class CustomAuthorizeAttribute: AuthorizeAttribute
{
    public string RequiredRole;
    public string LoginPage;

    protected override bool AuthorizeCore(HttpContextBase httpContext) 
    {


        if (httpContext == null) throw new ArgumentNullException("httpContext"); 

        if (httpContext.User != null)
        {
            if (httpContext.User.Identity.IsAuthenticated)
            {
                if (httpContext.User.Identity is FormsIdentity)
                {
                    FormsIdentity id = httpContext.User.Identity as FormsIdentity;
                    FormsAuthenticationTicket ticket = id.Ticket;
                    string role = ticket.UserData;

                    if (RequiredRole.Contains(role)) return true;
                }
            }
            else 
                return false;

        }
        return false;

    }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {

        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            var routeValues = new RouteValueDictionary();
            if (LoginPage == "Club")
            {
                routeValues["action"] = "Index";
                routeValues["controller"] = LoginPage;
                routeValues["ReturnUrl"] = filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectToRouteResult(routeValues);
            }
            else {
                routeValues["area"] = "mobile";
                routeValues["action"] = "login";
                routeValues["controller"] = LoginPage;
                routeValues["ReturnUrl"] = filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectToRouteResult(routeValues);
            }
        }

    }

}