Requiring authentication for a whole ASP.Net MVC site
This is easy from ASP.NET MVC 4 onwards: http://blogs.msdn.com/b/rickandy/archive/2012/03/23/securing-your-asp-net-mvc-4-app-and-the-new-allowanonymous-attribute.aspx You can register a filter that will require users to be authenticated to access all controllers public static void RegisterGlobalFilters(GlobalFilterCollection filters) { filters.Add(new HandleErrorAttribute()); filters.Add(new System.Web.Mvc.AuthorizeAttribute()); } but then they won’t be able to access to the Login controller, so you simply add the [AllowAnonymous] attribute to that controller: [AllowAnonymous] public ActionResult Login(string returnUrl) [HttpPost] [AllowAnonymous] [ValidateAntiForgeryToken] public ActionResult Login(LoginModel model, string returnUrl)