0

I have the following site configuration for my Sitecore 9.1 site:

<site name="the-website" patch:after="site[@name='modules_website']"
            language="en"
...                
            loginPage="/auth/login" />

In Sitecore we setup access rights like this:

/sitecore/content/root = Everyone deny read + descendants
/sitecore/content/root/website = break inheritance + descendants, 'extranet\authorized-users' read
/sitecore/content/root/website/Settings = Everyone read
/sitecore/content/root/website/Global = Everyone read
/sitecore/content/root/website/Home/Access denied = Everyone read

This ensures that endusers are redirected to the login page if not logged in and we can redirect users with valid login credentials, but invalid roles, to the access-denied page.

However, if endusers users are redirected to the access-denied page, they can manually type in a valid url, like /en-gb/welcome (which would be located in Sitecore at /sitecore/content/root/website/home/welcome) and they are shown the Sitecore no-access page instead of the login page.

They get the error message 'Permission to the requested document was denied - The resource you have requested requires read access"

How can we ensure that users are redirected to the login page if they manually edit the url, after being shown the /access-denied page?

1

Here we are going to discuss request specific authentication if user manually going to any login related page using URL manipulation, we can redirect user to login/access denied page.

If website has few pages where we don't want authenticate request like static pages(FAQ,help,privacy policy etc).

We add field at base page template "Is Authentication Required", if it is check then authentication will be checked. see below screen shot.

enter image description here

Even site root level add Internal link field under Page URL section we can define Login Page/Access Denied page. This implementation will be worked for multi-sites, as below screen shot.

enter image description here

Here we are going to handle this case using httpRequestBegin pipeline. Please have a look into sample code:


public class ValidateUserSession: HttpRequestProcessor
{
    public override void Process(HttpRequestArgs args)
    {
        var request = HttpContext.Current.Request;

        //If Sitecore CMS URL then skip check
        if (SitecoreContext.IsCMSRequest())
        {
            return;
        }

        var currentPage = Context.Database.GetItem(Context.Item.ID);
        //field at item page level i.e. "Is Authentication Required" ex- FAQ,help is not required.
        bool isAuthRequired = currentPage["Is Authentication Required"]?.ToString() == "1";

        if (!Context.User.IsAuthenticated && isAuthRequired)
        {
            //redirectUrl is login page/access denied
            WebUtil.Redirect(redirectUrl);
        }

    }

    /// <summary>
    /// Is CMS related request
    /// </summary>
    /// <returns></returns>
    public static bool IsCMSRequest()
    {
        return (HttpContext.Current != null && HttpContext.Current.Request.Url.Segments.Length > 1 && HttpContext.Current.Request.Url.Segments[1].Contains(Constants.Common.Sitecore)) // Starting request with "sitecore/"
      || Context.PageMode.IsExperienceEditor || Context.PageMode.IsDebugging || Context.PageMode.IsPreview || Context.User.IsAdministrator;
    }
}

Above code if any CMS specific request then it'll skip using IsCMSRequest() method.

Patch config file

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<httpRequestBegin>
<processor type=”Sitecore.Foundation.Forms.Pipelines.ValidateUserSession, Sitecore.Foundation.Forms” patch:after=”*[@type=’Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel’]”/>
</httpRequestBegin>
</pipelines>
</sitecore>
</configuration>

Kindly let me know if any query.

0

Sitecore has some out of the box error pages in the webroot below \sitecore\service one of them is the noaccess.aspx

Similar for the 404 not found page you can adjust this in the Sitecore config.

See this setting:

<!--
  ACCESS DENIED HANDLER
            Url of page handling 'Acess denied' errors

--><setting name="NoAccessUrl" value="/sitecore/service/noaccess.aspx"/>

You can adjust the url and/or create some logic to handle this noaccess situation.

  • Thanks for the suggestion! This page is not maintainable through Sitecore, though? – Hos May 23 at 7:50
  • correct not maintainable, but you can overwrite the file, or better create your own page on a different location and patch the config. Than you can make it maintainable, editable in Sitecore. – Jan Bluemink May 23 at 7:55
  • Do you have an example of this "create your own page on a different location and patch the config. Than you can make it maintainable, editable in Sitecore"? It sounds very interesting! – Hos May 23 at 8:23
  • See community.sitecore.net/developers/f/8/t/3924 for more background.. basically you can change the URL to a page you maintain in Sitecore, but you need care of the http statuscode. – Jan Bluemink May 23 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.