Custom authorize attribute

CustomAuth.cs

using System;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;

namespace Common
{
    public class CustomAuthAttribute : AuthorizeAttribute
    {
        private ApplicationUserManager _userManager;
        public ApplicationUserManager UserManager
        {
            get
            {
                return _userManager ?? HttpContext.Current.GetOwinContext()
                    .GetUserManager<ApplicationUserManager>();
            }
            private set
            {
                _userManager = value;
            }
        }

        private readonly string[] _allowedRoles;

        public CustomAuthAttribute(params string[] roles)
        {
            _allowedRoles = roles;
        }
        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            var userId = httpContext.User.Identity.GetUserId();

            if (userId == null)
            {
                return false;
            }

            var userRoles = UserManager.GetRolesAsync(userId).Result;
            var canAccess = _allowedRoles.Any(x => userRoles.Contains(x));

            if (canAccess) return true;
            return false;
        }
    }
}