title: Authorization for ASP.NET MVC site
body: <p>I have a data driven asp.net mvc app. The Url of the pages is data driven too, so they cannot be hardcoded in web.config.
  We are ready to deploy the website and for initial few days we want the pages to be accessible only after logging in.</p>
  
  <p>Is it possible to add authorization to the site and then take it out by changing the web.config only?
  I have added this:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="Login.aspx" timeout="20"&gt;
      &lt;credentials passwordFormat="Clear"&gt;
        &lt;user name="admin" password="adminpwd" /&gt;
      &lt;/credentials&gt;
    &lt;/forms&gt;
  &lt;/authentication&gt;
  &lt;authorization&gt;
    &lt;deny users="?" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>However, this doesn’t work.</p>
  
  <p>I have also tried location tag, but not sure what path to specify in that.</p>
  
  <pre><code>  &lt;location&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;deny users="?" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  </code></pre>
  
  <p>Please note: the default error page should work without authorization</p>
  
  <pre><code>&lt;customErrors mode="Off" defaultRedirect="/error"&gt;
  &lt;/customErrors&gt;
  </code></pre>
  
  <p>Can you help?</p>
  
  <p>Thanks!</p>