Sitecore CD instance - Restrict access to Sitecore folder without blocking keepalive.aspx?

Question

I have a CD/CM site which I hardened by restricting access to Sitecore by adding "sitecore" to the Hidden Segments in the Request Filtering section in IIS (second answer here). However, this has blocked access to /sitecore/service/keepalive.aspx, and I am getting errors logged every time the keepalive service runs.

Is there a way to block the entire sitecore folder on CD except for sitecore/services? I expect I could add each subfolder to the Hidden Segments but I'm not sure if there's a better solution.

Answer 1

I'm not aware of a way to do what you are asking because deny permissions are always stronger than grant permissions, so the instruction to deny access to /sitecore/* would beat the instruction to grant access to /sitecore/service/keepalive.aspx.

Instead, I would recommend following Sitecore's Security Hardening Guide (section 1.5):

To restrict access to the client interfaces, we recommend that you implement IP-based security restrictions or disable Anonymous IIS access to the /sitecore/admin, /sitecore/login, /sitecore/shell folders and to the /sitecore/default.aspx page.

Also related (from the same section):

The /sitecore/service folder should be excluded from the IIS restrictions because it contains a number of service ASPX pages that are used by Sitecore to report various conditions that can occur in the application, such as, 404 Page Not Found or 403 Forbidden to the web client.

However, you can move the files from the /sitecore/service folder to the /sitecore folder. If you move the files, you must also update the following settings in the web.config file:

• ErrorPage
• NoAccessUrl
• NoLicenseUrl
• LayoutNotFoundUrl
• ItemNotFoundUrl
• LinkItemNotFoundUrl

Answer 2

You can also handle that with authorization in web.config:

<!-- Deny users access to internal paths -->
<location path="sitecore">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="xsl">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="sitecore modules">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="sitecore/service">
    <system.web>
        <authorization>
            <allow users="*"/>
            <!--heartbeat, keepalive, ect. must be accessible-->
        </authorization>
    </system.web>
</location>
<location path="sitecore/shell/Webservice/Service.asmx">
    <system.web>
        <authorization>
            <allow users="*"/>
            <!--allow webservice-->
        </authorization>
    </system.web>
</location>

Best regards Dirk