forms authentication problema

Question

asp.net 3.5

consigo navegar para default.aspx sem passar pelo login

web.config abaixo

    <authentication mode="Forms" >
      <forms loginUrl="login.aspx" protection="All" timeout="10" />
    </authentication >
    <authorization>
      <allow users="*"/>
      <deny users="?"/>
    </authorization>