授权属性工作异常

我扩展了Authorize属性以包含来自cookie的角色。调试给出了良好的结果，它相应地返回true或false。但是，如果我首先以"Admin"角色登录，然后尝试转到需要User角色的控制器，则Authorize返回false，但控制器仍然允许访问。

protected override bool AuthorizeCore(HttpContextBase httpContext) 
    {

        if (httpContext == null) throw new ArgumentNullException("httpContext"); 
        if (httpContext.User != null)
        {
            if (httpContext.User.Identity.IsAuthenticated)
            {
                if (httpContext.User.Identity is FormsIdentity)
                {
                    FormsIdentity id = httpContext.User.Identity as FormsIdentity;
                    FormsAuthenticationTicket ticket = id.Ticket;
                    string role = ticket.UserData;
                    if (RequiredRole.Contains(role)) return true;
                }
            }
            else 
                return false;
        }
        return false;
    }

Requiredrole是类的一个属性。

 [CustomAuthorize(RequiredRole = "Admin", LoginPage = "Club")]
public class UsuarioAdminController : Controller
{

上面的代码用于需要admin角色的控制器。

[CustomAuthorize(RequiredRole = "User", LoginPage = "Club")]
public class HotelController : Controller
{

上面的代码用于具有User角色的控制器。有人知道为什么如果授权返回false，它允许访问吗?由于

AuthorizeCore属性的行为符合预期，它返回真或假;但是，当AuthorizeCore方法返回false时，控制器允许访问。

是的，有更多的代码，但我不认为这有什么不同…

public class CustomAuthorizeAttribute: AuthorizeAttribute
{
    public string RequiredRole;
    public string LoginPage;
    protected override bool AuthorizeCore(HttpContextBase httpContext) 
    {

        if (httpContext == null) throw new ArgumentNullException("httpContext"); 
        if (httpContext.User != null)
        {
            if (httpContext.User.Identity.IsAuthenticated)
            {
                if (httpContext.User.Identity is FormsIdentity)
                {
                    FormsIdentity id = httpContext.User.Identity as FormsIdentity;
                    FormsAuthenticationTicket ticket = id.Ticket;
                    string role = ticket.UserData;
                    if (RequiredRole.Contains(role)) return true;
                }
            }
            else 
                return false;
        }
        return false;
    }
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            var routeValues = new RouteValueDictionary();
            if (LoginPage == "Club")
            {
                routeValues["action"] = "Index";
                routeValues["controller"] = LoginPage;
                routeValues["ReturnUrl"] = filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectToRouteResult(routeValues);
            }
            else {
                routeValues["area"] = "mobile";
                routeValues["action"] = "login";
                routeValues["controller"] = LoginPage;
                routeValues["ReturnUrl"] = filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectToRouteResult(routeValues);
            }
        }
    }
}