感謝：https://blog.csdn.net/duyunzhi/article/details/89215917 提供思路

感謝：https://q.cnblogs.com/q/111311 提問，提供解決方案

用原生的 Attribute 是達不到效果必須重寫

public class LoginAuthorizationFilter : Attribute, IAuthorizationFilter
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private ISession _session => _httpContextAccessor.HttpContext.Session;

        public AdminLoginAuthorizationFilter(IHttpContextAccessor httpContextAccessor)
        {
            _httpContextAccessor = httpContextAccessor;
        }
        public void OnAuthorization(AuthorizationFilterContext context)
        {
            //也可以這樣獲取Session，就不需要注入了。
            var testData = context.HttpContext.Request.Cookies.TryGetValue("User", out string value);
            if (!testData || string.IsNullOrWhiteSpace(value))
            {
                ContentResult Content = new ContentResult();
                Content.Content = "<script type='text/javascript'>parent.window.location.href='/User/Login'</script>";
                Content.ContentType = "text/html";
                //截斷請求
                context.Result = Content;
            }
        }
    }

使用 [TypeFilter(typeof(LoginAuthorizationFilter))]