Question

When the user enters the correct username and password, he/she will be presented with the MyNewPage.aspx page. This part works properly. But, when I type http://localhost:49296/Pages/MyNewPage directly in the browser window without logging in I still am able to access this page. What I want to do is to restrict users accessing this page without signing in.

How can I do this?

        [HttpPost]
        public ActionResult LogOn(LogOnModel model, string returnUrl)
        {
            if (ModelState.IsValid)
            {
                if (Membership.ValidateUser(model.UserName, model.Password))
                {
                    FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);
                    if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                        && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                    {
                        return Redirect(returnUrl);
                    }
                    else
                    {
                        return RedirectToAction("MyNewPage", "Pages");

                    }
                }                
            }    
            return View(model);
        }

Answer 1

Put

[Authorize]

on the controller/action