title: Authorization with Session variables in asp net mvc 5
body: <p>So my project requirements changed and now I think I need to build my own action filter.</p>
  
  <p>So, this is my current login controller:</p>
  
  <pre><code> public class LoginController : Controller
  {
      // GET: Login
      public ActionResult Index()
      {
          return View();
      }
  
      [HttpPost]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
  
      public ActionResult Login(LoginViewModel model)
      {  
          string userName = AuthenticateUser(model.UserName, model.Password);
          if (!(String.IsNullOrEmpty(userName)))
          {
              Session["UserName"] = userName;
              return View("~/Views/Home/Default.cshtml");
          }
  
          else
          {
              ModelState.AddModelError("", "Invalid Login");
              return View("~/Views/Home/Login.cshtml");
          }
      }
  
      public string AuthenticateUser(string username, string password)
      {
          if(password.Equals("123")
              return "Super"
          else
              return null;
      }
  
      public ActionResult LogOff()
      {
          Session["UserName"] = null;
          //AuthenticationManager.SignOut();
          return View("~/Views/Home/Login.cshtml");
      }
  }
  </code></pre>
  
  <p>And this is my action filter attempt:</p>
  
  <pre><code>public class AuthorizationFilter : ActionFilterAttribute
  {
      public override void OnActionExecuting(ActionExecutingContext filterContext)
      {
          if (HttpContext.Current.Session["UserName"] != null)
          {
              filterContext.Result = new RedirectToRouteResult(
                     new RouteValueDictionary{{ "controller", "MainPage" },
                                        { "action", "Default" }
  
                                       });
          }
          base.OnActionExecuting(filterContext);
      }
  }
  </code></pre>
  
  <p>I have already added it to FilterConfig, but when I login it does not load Default.cshtml it just keeps looping the action filter. The action result for it looks like this:</p>
  
  <p>//this is located in the MainPage controller</p>
  
  <pre><code> [AuthorizationFilter]
      public ActionResult Default()
      {
          return View("~/Views/Home/Default.cshtml");
      }
  </code></pre>
  
  <p>So, what would I need to add in order to give authorization so only authenticated users can view the application´s pages? Should I use Session variables or is there another/better way of doing this using? I am pretty much stuck with AuthenticateUser(), since what happens there now is just a simple comparison like the one we have there now.</p>
  
  <p>Thank you for your time. </p>