title: ASP.NET MVC Forms authentication and unauthenticated controller actions
body: <p>I have a ASP.NET MVC site that is locked down using Forms Authentication. The web.config has </p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
      &lt;forms defaultUrl="~/Account/LogOn" loginUrl="~/Account/LogOn" timeout="2880"/&gt;
  &lt;/authentication&gt;
  &lt;authorization&gt;
      &lt;deny users="?"/&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>None of my pages other than Account/LogOn can be viewed unless the user is authenticated. </p>
  
  <p>Now I am trying to add PayPal IPN to my site and in order to do that I need to have two pages that handle PayPal's payment confirmation and thank you page. These two pages need to be available for anonymous users. </p>
  
  <p>I would like these pages to be controller actions off my Account controller. Is there any way I can apply an attribute to specific action methods that make them available to anonymous users? I found a several posts here that attempt to do that but there was most people wanted the opposite scenario. </p>
  
  <p>Basically I want may <code>AccountController</code> class to have no authorization for most of the methods except for a few. Right now it looks like only the LogOn method is available to anonymous users.</p>