1、重寫AuthorizeAttribute類，用自己的許可權控制邏輯重寫AuthorizeCore方法

public class MyAuthorizeAttribute : AuthorizeAttribute 
    {

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            string currentRole = (Session["user"] as User).Role;
            //從Session中獲取User物件，然後得到其角色資訊。如果使用者重寫了Identity, 則可以在httpContext.Current.User.Identity中獲取
            if (Roles.Contains(currentRole))
                return true;
            return base.AuthorizeCore(httpContext);
        }

    }
 

 [MyAuthorize(Roles = "Admin, User")]
        public ActionResult AuthorizeMethod2()
        {
            return View();
        }