Hi Alex,

Here's a couple of ways:

First option is to utilise Episerver's built in Membership Provider and setup a "read" access only to your custom group, removing groups like "Everyone"

1. Set up a new group, i.e. "MySecretsGroup" and add a User "MySecretUser"
2. On your pages that you want to password-protect, remove the "Read" access from all groups, including "Everyone"
3. When an end-user hits your password protected page, Episerver will serve the default login screen but will redirect to the frontend view page after authenticating the user (not the CMS)

Second option is to create your own CustomAuthorizeAttribute.cs and decorate your page type controller with this attribute (how you usually would in .NET MVC)

1. Create a class CustomAuthorizeAttribute : AuthorizeAttribute (.NET [Authorize], implementing the relevant members)
2. Create a new page type PasswordProtectedPage and decorate the controller of your page type with [CustomAuthorize]
3. When an end-user hits a page with your specific page type, your custom auth implementation will kick in

Hi Nicola,

Many thanks for your reply. Both options look interesting, I'll give them a go!