You could use Forms authentication. What I usually do is place the pages I want to secure in a separate folder than the web site's root, then secure that folder. You can either use a separate (partial) web.config in that folder, or you can use the location element to control access. For example, a typical web.config might look like (fragment): <authentication mode="Forms"> <forms loginUrl="AccessDenied.aspx" name="SomeAuthCookieName" timeout="60" path="/" /> </authentication> <authorization> <allow users="?" /> </authorization> <location path="SecuredFiles"> <system.web> <authorization> <allow roles="SpecialPeople" /> <deny users="*" /> </authorization> </system.web> </location> In the example above, anything in the root folder would be accessible to pretty much anyone who visited the site (test2.aspx in your example would go at the root, as would login.aspx). Anything in the SecuredFiles folder would be unbrowsable to anyone not in the SpecialPeople role (so, test1.aspx would go in there). Hope this helps.
The most exciting phrase to hear in science, the one that heralds the most discoveries, is not 'Eureka!' ('I found it!') but 'That's funny...’