title: ASP.NET MVC: Can I say [Authorize Roles="Administrators"] on the Controller class, but have one public action?
body: <p>I started off using the default project's <code>AccountController</code>, but I've extended/changed it beyond recognition. However, in common with the original I have a <code>LogOn</code> and <code>LogOff</code> action. </p>
  
  <p>Clearly, the <code>LogOn</code> action must be accessible to everyone. However, since I've added lots of other actions to this controller (to create &amp; edit users), I want 99% of the actions to require administrator role membership.</p>
  
  <p>I could decorate all my actions with <code>[Authorize Roles="Administrators"]</code> but there's a risk I'll forget one. I'd rather make it secure by default, by decorating the controller class itself with that attribute, and then relax the requirement on my <code>LogOn</code> method. Can I do that?</p>
  
  <p>(As in, can I do that out-of-the-box without creating custom classes, etc. I don't want to complicate things more than necessary.)</p>