2

I'm using Sitecore 8.0 update 6 and following Sitecore security hardening documentation.

I'd like to redirect user when the request is made to https://www.foo.com/sitecore to https://www.foo.com/404.

There is 404 item present in Sitecore. I have also updated the settings for below configuration to point /404

  • NoAccessUrl

  • LayoutNotFoundUrl

  • ItemNotFoundUrl

  • LinkItemNotFoundUrl

However I'm receiving below error from IIS instead of /404 page.

enter image description here

3

3 Answers 3

0

It seems that /sitecore folder is restricted at IIS level which is of-course recommended as per Sitecore best practices, that's why you are seeing that unauthorized access message. If you want to show some custom page (e.g 404) then I think you have to manage at IIS level for error code 401.2.

1
  • I have not disable anonymous authentication to /sitecore folder as i'm using /services folder inside it. Only login, admin, debug folder are disabled for anonymous access. Jun 7, 2018 at 12:44
0

Since you are blocking the request at the IIS level, Sitecore is never seeing it. You just need to add the proper 404 config in your web.config. Then IIS will handle it properly.

<configuration>
    <system.webServer>      
        <httpErrors errorMode="Custom" existingResponse="Auto">
            <remove statusCode="403" />
            <remove statusCode="404" />
            <remove statusCode="500" />
            <error statusCode="500" responseMode="File" path="/500.html" />
            <error statusCode="403" responseMode="Redirect" path="/404.html" />
            <error statusCode="404" responseMode="Redirect" path="/404.html" />
        </httpErrors>
    </system.webServer>

    <system.web>
        <customErrors mode="On" defaultRedirect="500.html" redirectMode="ResponseRewrite">
            <error statusCode="403" redirect="/404.html" />
            <error statusCode="404" redirect="/404.html" />
            <error statusCode="500" redirect="/500.html" />
        </customErrors>
    </system.web>
</configuration>

And you will need to make sure you IP denial is set to "Non Found" via "Edit Feature Settings" when you click on your IP rule.

enter image description here

0

Since you have restricted access on sitecore folder, IIS is throwing 403. The request is not even hitting sitecore, that's why you are seeing IIS error page. If you want to show custom error page, you can do a redirection in Global.asax

protected void Application_Error(Object sender, EventArgs e)
{
     Exception ex = this.Server.GetLastError();

     if(ex is HttpException)
     {
          HttpException httpEx = (HttpException)ex;

          if(httpEx.GetHttpCode() == 403)
          {
               Response.Redirect("/404");
          }
     }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.