title: How to implement authorization checks in ASP.NET MVC based on Session data?
body: <p>This will be my first ASP.NET MVC application with forms authentication so I am trying to make sure I don't miss anything. The scenario is this: Public / Secured Areas.</p>
  
  <p>Within the private area it is even further limited to specific areas / user. These 'Areas' are defined by customizations to the base area that is customized per user group.</p>
  
  <p>So for example a user could get to url <code>/Area/Controller/Action</code>.  They would need to have permission to the secured area or they would be redirected to the sign-in view.</p>
  
  <p>I have been reading about the <code>AuthorizeAttribute</code> but I am not sure how/where I should be doing these basic checks.  My initial hunch would be to store a user object in the session after a successful sign-in with the user's IP and details about what they have access to etc.</p>
  
  <p>The authorization check for each secured controller call would verify that a valid user object exists in the session, the IPs still match up, and the user has access to the specific area.  Is there any obvious holes to this setup?</p>
  
  <p><strong>Edit:</strong> Where/how do I implement these checks so that when a controller is tagged with [Authorize] it will perform those session object checks?</p>
  
  <p>Any pointers or suggestions would be much appreciated.  Thanks.</p>