1

I'm using Sitecore 8.0 update 6 and following Sitecore security hardening documentation.

I'd like to redirect user when the request is made to https://www.foo.com/sitecore to https://www.foo.com/404.

There is 404 item present in Sitecore. I have also updated the settings for below configuration to point /404

  • NoAccessUrl

  • LayoutNotFoundUrl

  • ItemNotFoundUrl

  • LinkItemNotFoundUrl

However I'm receiving below error from IIS instead of /404 page.

enter image description here

0

It seems that /sitecore folder is restricted at IIS level which is of-course recommended as per Sitecore best practices, that's why you are seeing that unauthorized access message. If you want to show some custom page (e.g 404) then I think you have to manage at IIS level for error code 401.2.

| improve this answer | |
  • I have not disable anonymous authentication to /sitecore folder as i'm using /services folder inside it. Only login, admin, debug folder are disabled for anonymous access. – Mohit Dharmadhikari Jun 7 '18 at 12:44
0

Since you are blocking the request at the IIS level, Sitecore is never seeing it. You just need to add the proper 404 config in your web.config. Then IIS will handle it properly.

<configuration>
    <system.webServer>      
        <httpErrors errorMode="Custom" existingResponse="Auto">
            <remove statusCode="403" />
            <remove statusCode="404" />
            <remove statusCode="500" />
            <error statusCode="500" responseMode="File" path="/500.html" />
            <error statusCode="403" responseMode="Redirect" path="/404.html" />
            <error statusCode="404" responseMode="Redirect" path="/404.html" />
        </httpErrors>
    </system.webServer>

    <system.web>
        <customErrors mode="On" defaultRedirect="500.html" redirectMode="ResponseRewrite">
            <error statusCode="403" redirect="/404.html" />
            <error statusCode="404" redirect="/404.html" />
            <error statusCode="500" redirect="/500.html" />
        </customErrors>
    </system.web>
</configuration>

And you will need to make sure you IP denial is set to "Non Found" via "Edit Feature Settings" when you click on your IP rule.

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.