I am trying to check Read permission for the current user on a specific item like the following:


This always returns true even though the 'Access Viewer' shows revoked 'Read' permission for the same user.

The revoking has been done using Roles.

What is wrong with this code?


This code is being run from publish:begin event. The Sitecore.Context.User does have the required (logged-in) user. I see this on the AccessViewer (I have edited the code to CanWrite()): enter image description here But both options mentioned in the answers always return True.

4 Answers 4


The code you have posted will always return true by the nature of how Sitecore security works. If SelectItems() returns an item, that means the Sitecore.Context.User can read it. If the current user did not have access to the item, it would return null.

So you have options depending on your use case. If you just want to restrict the current context users read access to an item, then just set the security on the item, the Sitecore API will do the rest for you.

If you want to check a users security, then you need to be logged in as someone who has read access and then use a User object to check the secuity.

var user = Sitecore.Security.Accounts.User.FromName(domainUser, false);
var item = Sitecore.Data.Database.GetDatabase("master")

// Option 1, pass in the user
var readAccess = item.Security.CanRead(user)

// Option 2, use a switcher
using (new Sitecore.Security.Accounts.UserSwitcher(user))
   readAccess = item.Access.CanRead();

Thought I would introduce you to something with a change in approach.

Sitecore PowerShell Extensions

Example: The following returns the security objects associated with an item. No results indicate nothing specified explicitly.

$path = "/sitecore/content/Concentra/DotCom/usa/Home"
Get-Item -Path $path | Get-ItemAcl

Account                          AccessRight          PermissionType   PropagationType  SecurityPermission
-------                          -----------          --------------   ---------------  ------------------
sitecore\michael                 item:read            Access           Entity           AllowAccess

Example: The following returns a true/false value indicating that the user has item:read access to the item.

$user = "sitecore\michael"
$path = "/sitecore/content/Concentra/DotCom/usa/Home"
Test-ItemAcl -Identity $user -Path $path -AccessRight item:read


We also have a report in SPE called Items with security for an account.

Report of items with security


Can you try :

Sitecore.Security.Accounts.User user = Sitecore.Security.Accounts.User.FromName(domainUser, false);
// UserSwitcher allows below code to run under a specific user 
using (new Sitecore.Security.Accounts.UserSwitcher(user))
   var ReadAccess = item.Access.CanRead();


This is the definition of method CanRead :

public virtual bool CanRead()
    return this.IsAllowed(this._item, AccessRight.ItemRead);

What namespace are you using for your CanRead method because I don't find this method with parameters?


Looks like you use this method :

public virtual bool CanRead(Account account)
    Assert.ArgumentNotNull(account, "account");
    return AuthorizationManager.IsAllowed(this._item, AccessRight.ItemRead, account);

from the class: Sitecore.Security.AccessControl.ItemSecurity .

Please change your code and use my example or Richard example.

  • 1
    There are two ways for this: one with the user as a parameter item.Security.CanRead(user) and the other using the current user context in item.Access.CanRead()
    – TamerM
    Commented Oct 18, 2016 at 15:38
  • what is the namespace for the first method? Commented Oct 18, 2016 at 15:40
  • Oh sorry: Sitecore.Security.AccessControl
    – TamerM
    Commented Oct 18, 2016 at 15:50

I was also facing that same issue (read access was always true, even check with user viwer in sitecore), So I tried an alternative to achieve the solutions:

string accessValue = standardFieldValueItem.Fields["__Security"].Value; string[] spliter = new string[] { "au|" };

string[] usersAccess = accessValue.Split(spliter, StringSplitOptions.None); bool isNotReadAccess = false; foreach (var userAccess in usersAccess) { if (userAccess.Contains(u.DisplayName)) { isNotReadAccess = userAccess.Contains("-item:read"); } }

  • 1
    This will only work when security is set in specific items. If you are relying on inheritance from parent item(s) then the __Security field will be blank even though the user does have read access.
    – jammykam
    Commented Aug 23, 2017 at 15:25
  • yes it is @jammykam , and for this actually on item checking recursively for standard value then performing this operation. If that item inherited with many parents item then it will check recursively. Commented Jan 3, 2018 at 5:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.