asp.net mvc 3 - How Authorize attribute work in MVC3 -

i research mvc3 , read alot article or watch video on asp.net website. after have knowledge mvc3 , have question authorize attribute authenticate user login or not. default code when create page authenticate user this:

[httppost]     public actionresult logon(logonmodel model, string returnurl)     {         if (modelstate.isvalid)         {             if (membership.validateuser(model.username, model.password))             {                 formsauthentication.setauthcookie(model.username, model.rememberme);                 if (url.islocalurl(returnurl) && returnurl.length > 1 && returnurl.startswith("/")                     && !returnurl.startswith("//") && !returnurl.startswith("/\\"))                 {                     return redirect(returnurl);                 }                 else                 {                     return redirecttoaction("index", "home");                 }             }             else             {                 modelstate.addmodelerror("", "the user name or password provided incorrect.");             }         }          // if got far, failed, redisplay form         return view(model);     } 

if don't want use membership , formsauthentication (don't windows authentication) authorize user. there way create authenticate user , when use authorize attribute work when use membership , formsauthentication. don't know authorize attribute use authenticate user login or not, can create session or cookie myself authenticate user. if question not clear , please let me know! reading!

what can roll own authorise attribute this:

public class authorizeattribute : system.web.mvc.authorizeattribute {      protected override bool authorizecore(system.web.httpcontextbase httpcontext)     {         //put authorisation check here     }      protected override void handleunauthorizedrequest(authorizationcontext filtercontext)     {         //put redirect login controller here     } }