Login Page accessible in Multisite scenario in Production

Question

We are having a Multi-lingual site. In Production, Sitecore Login page is accessible for all the sites except the .com (en-US) site.

For en-US site, the user is redirected back to home page when they are trying to access www.oursite.com/sitecore. Thus the necessary configuration is already in place.

<rewrite>
      <rules>
        <rule name="Root Hit Force HTTPS Redirection" enabled="true" stopProcessing="true">
          <match url="^$" ignoreCase="false"/>
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$"/>
            <add input="{HTTP_METHOD}" pattern="GET"/>
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/" redirectType="Permanent"/>
        </rule>
        <rule name="Sitecore Login or Admin Force HTTPS Redirection" enabled="true" stopProcessing="true">
          <match url="^(sitecore/(login|admin))$"/>
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$"/>
            <add input="{HTTP_METHOD}" pattern="GET"/>
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent"/>
        </rule>
        <rule name="Forbidden" enabled="true" stopProcessing="true">
          <match url="(.*)"/>
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$"/>
            <add input="{HTTP_METHOD}" pattern="GET"/>
          </conditions>
          <action type="CustomResponse" statusCode="403" subStatusCode="0"/>
        </rule>
      </rules>
    </rewrite>

Can anyone point me out where exactly we missed?

Answer 1

I believe your redirect is incorrect. From what I can tell, your rewrite rule above is just forcing HTTPS if somebody accesses the sitecore url, it isn't actually blocking it.

My memory is fuzzy on the regex stuff for rewrites, but it looks like this is looking for an HTTP call only (HTTPS pattern is OFF). Since your first rule matches against all URLs with HTTPS pattern off, this rule will never fire.

You probably want to remove the HTTPS condition so that it gets run against all requests matching that URL format.