diff --git a/src/Web/Controllers/AccountController.cs b/src/Web/Controllers/AccountController.cs
index ca01367..89f08cf 100644
--- a/src/Web/Controllers/AccountController.cs
+++ b/src/Web/Controllers/AccountController.cs
@@ -11,6 +11,7 @@ using ApplicationCore.Interfaces;
 namespace Microsoft.eShopWeb.Controllers
 {
     [Route("[controller]/[action]")]
+    [Authorize]
     public class AccountController : Controller
     {
         private readonly UserManager<ApplicationUser> _userManager;
diff --git a/src/WebRazorPages/Startup.cs b/src/WebRazorPages/Startup.cs
index 60ba8be..743dc94 100644
--- a/src/WebRazorPages/Startup.cs
+++ b/src/WebRazorPages/Startup.cs
@@ -104,7 +104,11 @@ namespace Microsoft.eShopWeb.RazorPages
             // Add memory cache services
             services.AddMemoryCache();
 
-            services.AddMvc();
+            services.AddMvc()
+                .AddRazorPagesOptions(options =>
+                {
+                    options.Conventions.AuthorizeFolder("/Order");
+                });
 
             _services = services;
         }