title: How to lock down paths in ASP.NET MVC?
body: <p>I'm playing around with MVC 4 for the first time to check out what's been changed/added/etc compared to MVC 3.</p>
  
  <p>To start off, I created a blank MVC 4 Web Application and started building from scratch.</p>
  
  <p>One of the first things that I noticed that is different in MVC 4 is the fact that the following web.config settings have no affect on the accessibility of the web pages:</p>
  
  <pre><code>&lt;configuration&gt;
      &lt;location path=""&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;deny users="?"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
      &lt;/location&gt;
      .....
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Back in MVC 3, the authorization settings above would deny all anonymous users from accessing any content within the site. However, if I add the same settings to an MVC4 Web.config file, an anonymous has free reign over an URL that s/he chooses.</p>
  
  <p>What do I need to do in MVC 4 to lock-down all paths like I did in MVC 3?</p>