I'm encountering an issue which I can't resolve : using explore mode in the experience editor, I get 403 errors when trying to see any of the data from the current visit (the tabs and accordions are all blank).

I've added some patches to try and fix api access, including Sitecore.Services.SecurityPolicy and Sitecore.Services.AllowAnonymousUser. These patches do help me access the apis, which are now available from my browser. But the issue persists within the experience editor, and I get the following 403 errors on urls that ARE accessible through normal browsing in a new tab.

Sitecore 403 forbidden on experience editor

Do you have any hints on this ? I've been on it for a few days... Thanks a lot for your help !

  • Have you tried giving access to the IIS User and Network service on the website folder including subfolders? – Hishaam Namooya Jul 30 '18 at 17:11
  • Are there more details in the JSON response from those requests? Do you happen to have an SXA tenant setup? – Jeroen Jul 31 '18 at 17:39
  • @Hishaam yes this was on my local environment and I made sure to give all access to every IIS user just to be sure this wasn't it. – VMHBD Aug 1 '18 at 6:10
  • @Jeroen The JSON response from these requests specifies that a token is missing from the api request. I have an ongoing ticket with Sitecore regarding the lack of token sent from Experience Explorer, I will update when they answer. – VMHBD Aug 1 '18 at 6:17

This issue is created by a lack of token sent by the Experience Editor to Sitecore APIs. I do not know why it fails to send the security key, but in the meantime this setting enables you to bypass authorization, letting you work with Experience Explorer : <setting name="Sitecore.Web.IsAuthorizationBypassAllowed" value="true" />.

I do NOT recommend keeping this on but it can be useful when you really need to do a POC or test your marketing definitions. Keep in mind that this is a security breach and should not be used in a public environment.

| improve this answer | |
  • Did you try removing your cookies and logging in again? This seems to resolve this issue in most cases see also here sitecore.stackexchange.com/questions/4147/… – Jeroen Aug 1 '18 at 15:06
  • @Jeroen actually the cookie is present but it seems like the token is either wrong or doesn't get interpreted correctly. I have 3 sitecore environments on which I noticed this behavior, even from any browser and two different computers. After totally removing cookies it does not work, and even removing only the token cookie only generates a new one at refresh which still does not work. – VMHBD Aug 7 '18 at 6:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.