Using an extension of AuthorizeAttribute causes the Roles restriction to be ignored
<p>I have the following extension of the AuthorizeAttribute (taken with minor modifications from <a href="http://johnskdev.com/prevent-concurrent-logins-from-a-single-user-account-in-net/" rel="nofollow">http://johnskdev.com/prevent-concurrent-logins-from-a-single-user-account-in-net/</a>):</p>

<pre><code> public class AuthorizeSingleLogin : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        bool isAuthorized = base.AuthorizeCore(httpContext);

        string user = httpContext.User.Identity.Name;

        string access = httpContext.Session.SessionID;

        if (String.IsNullOrEmpty(user) || String.IsNullOrEmpty(access))
        {
            return isAuthorized;
        }

        SQLLoginrecord sqlLogin = new SQLLoginrecord();

        return sqlLogin.IsLoggedIn(user, access);
    }
}
</code></pre>

<p>And in my Controller, I have:</p>

<pre><code>    [AuthorizeSingleLogin(Roles = "Users11")]
    public ActionResult User11Action()
    {
        return View();
    }
</code></pre>

<p>The problem is, this still lets me access the User11 View page even for a user who is not in that role. When I change the attribute to just Authorize, as follows:</p>

<pre><code>    [Authorize(Roles = "Users11")]
    public ActionResult User11Action()
    {
        return View();
    }
</code></pre>

<p>I get the access denied page that I expect from my app. How can I fix this so the extended AuthorizeSingleLogin respects the parameters that its parent supports?</p>

<p>Thank you.</p>