title: MVC 3 anoNynmous and Windows authentication combined
body: <p>I have a web application which is secured down by Windows authentication. However, I have one controller which needs to be available globally to anyone, so they do not need a Windows account on the server to be granted access.</p>
  
  <p>I have got this to work by enabling both Windows authentication, and Anonymous Authentication in IIS. My controllers now look like this:</p>
  
  <pre><code>[Authorize]
  public class MyController : Controller
  {
      public Index()
      {
      }
  
      public DoStuff()
      {
      }
  
      etc...
  }
  </code></pre>
  
  <p>My anonymous controller is the same, except I have removed the [Authorise] attribute from the start of it.</p>
  
  <p>Am I right in saying that this instructs the web application to only allow those users with a Windows account to use the majority of controllers, except for the controller which I want to allow anonymous access to?</p>
  
  <p>It seems to work just fine, but I wanted to ensure I have not left a gaping security hole open by doing this?</p>
  
  <p>Are there any issues with enabling both methods of authentication, and setting the application up in this way?</p>