I have the following site configuration for my Sitecore 9.1 site:
<site name="the-website" patch:after="site[@name='modules_website']" language="en" ... loginPage="/auth/login" />
In Sitecore we setup access rights like this:
/sitecore/content/root = Everyone deny read + descendants /sitecore/content/root/website = break inheritance + descendants, 'extranet\authorized-users' read /sitecore/content/root/website/Settings = Everyone read /sitecore/content/root/website/Global = Everyone read /sitecore/content/root/website/Home/Access denied = Everyone read
This ensures that endusers are redirected to the login page if not logged in and we can redirect users with valid login credentials, but invalid roles, to the access-denied page.
However, if endusers users are redirected to the access-denied page, they can manually type in a valid url, like /en-gb/welcome (which would be located in Sitecore at
/sitecore/content/root/website/home/welcome) and they are shown the Sitecore no-access page instead of the login page.
They get the error message 'Permission to the requested document was denied - The resource you have requested requires read access"
How can we ensure that users are redirected to the login page if they manually edit the url, after being shown the /access-denied page?