Hi Jonas,

If you want to prevent to access login, edit mode, admin mode completely then I suggest you other simple solution as following:

var publicFront = configuration.GetValue<bool?>("PublicFront");
if (publicFront.GetValueOrDefault(true))
{
    app.Use(async (context, requestDelegate) =>
    {
        if (context.Request.Path.StartsWithSegments("/util", StringComparison.OrdinalIgnoreCase)
        || context.Request.Path.StartsWithSegments("/episerver", StringComparison.OrdinalIgnoreCase))
        {
            context.Response.StatusCode = (int)HttpStatusCode.Forbidden;
            await context.Response.WriteAsync("Forbidden: Access Denied");
            return;
        }
        await requestDelegate(context);
    });
}