Sitecore content delivery server security hardening anonymous access

Question

I'm using Sitecore 8.0 update 6 and following Sitecore security hardening documentation.

I'd like to redirect user when the request is made to https://www.foo.com/sitecore to https://www.foo.com/404.

There is 404 item present in Sitecore. I have also updated the settings for below configuration to point /404

• NoAccessUrl

• LayoutNotFoundUrl

• ItemNotFoundUrl

• LinkItemNotFoundUrl

However I'm receiving below error from IIS instead of /404 page.

Answer 1

It seems that /sitecore folder is restricted at IIS level which is of-course recommended as per Sitecore best practices, that's why you are seeing that unauthorized access message. If you want to show some custom page (e.g 404) then I think you have to manage at IIS level for error code 401.2.

Answer 2

Since you are blocking the request at the IIS level, Sitecore is never seeing it. You just need to add the proper 404 config in your web.config. Then IIS will handle it properly.

<configuration>
    <system.webServer>      
        <httpErrors errorMode="Custom" existingResponse="Auto">
            <remove statusCode="403" />
            <remove statusCode="404" />
            <remove statusCode="500" />
            <error statusCode="500" responseMode="File" path="/500.html" />
            <error statusCode="403" responseMode="Redirect" path="/404.html" />
            <error statusCode="404" responseMode="Redirect" path="/404.html" />
        </httpErrors>
    </system.webServer>

    <system.web>
        <customErrors mode="On" defaultRedirect="500.html" redirectMode="ResponseRewrite">
            <error statusCode="403" redirect="/404.html" />
            <error statusCode="404" redirect="/404.html" />
            <error statusCode="500" redirect="/500.html" />
        </customErrors>
    </system.web>
</configuration>

And you will need to make sure you IP denial is set to "Non Found" via "Edit Feature Settings" when you click on your IP rule.

Answer 3

Since you have restricted access on sitecore folder, IIS is throwing 403. The request is not even hitting sitecore, that's why you are seeing IIS error page. If you want to show custom error page, you can do a redirection in Global.asax

protected void Application_Error(Object sender, EventArgs e)
{
     Exception ex = this.Server.GetLastError();

     if(ex is HttpException)
     {
          HttpException httpEx = (HttpException)ex;

          if(httpEx.GetHttpCode() == 403)
          {
               Response.Redirect("/404");
          }
     }
}