Sitecore redirects to no-access page instead of login page

Question

I have the following site configuration for my Sitecore 9.1 site:

<site name="the-website" patch:after="site[@name='modules_website']"
            language="en"
...                
            loginPage="/auth/login" />

In Sitecore we setup access rights like this:

/sitecore/content/root = Everyone deny read + descendants
/sitecore/content/root/website = break inheritance + descendants, 'extranet\authorized-users' read
/sitecore/content/root/website/Settings = Everyone read
/sitecore/content/root/website/Global = Everyone read
/sitecore/content/root/website/Home/Access denied = Everyone read

This ensures that endusers are redirected to the login page if not logged in and we can redirect users with valid login credentials, but invalid roles, to the access-denied page.

However, if endusers users are redirected to the access-denied page, they can manually type in a valid url, like /en-gb/welcome (which would be located in Sitecore at /sitecore/content/root/website/home/welcome) and they are shown the Sitecore no-access page instead of the login page.

They get the error message 'Permission to the requested document was denied - The resource you have requested requires read access"

How can we ensure that users are redirected to the login page if they manually edit the url, after being shown the /access-denied page?

Answer 1

Here we are going to discuss request specific authentication if user manually going to any login related page using URL manipulation, we can redirect user to login/access denied page.

If website has few pages where we don't want authenticate request like static pages(FAQ,help,privacy policy etc).

We add field at base page template "Is Authentication Required", if it is check then authentication will be checked. see below screen shot.

Even site root level add Internal link field under Page URL section we can define Login Page/Access Denied page. This implementation will be worked for multi-sites, as below screen shot.

Here we are going to handle this case using httpRequestBegin pipeline. Please have a look into sample code:

public class ValidateUserSession: HttpRequestProcessor
{
    public override void Process(HttpRequestArgs args)
    {
        var request = HttpContext.Current.Request;

        //If Sitecore CMS URL then skip check
        if (SitecoreContext.IsCMSRequest())
        {
            return;
        }
        
        var currentPage = Context.Database.GetItem(Context.Item.ID);
        //field at item page level i.e. "Is Authentication Required" ex- FAQ,help is not required.
        bool isAuthRequired = currentPage["Is Authentication Required"]?.ToString() == "1";

        if (!Context.User.IsAuthenticated && isAuthRequired)
        {
            //redirectUrl is login page/access denied
            WebUtil.Redirect(redirectUrl);
        }

    }

    /// <summary>
    /// Is CMS related request
    /// </summary>
    /// <returns></returns>
    public static bool IsCMSRequest()
    {
        return (HttpContext.Current != null && HttpContext.Current.Request.Url.Segments.Length > 1 && HttpContext.Current.Request.Url.Segments[1].Contains(Constants.Common.Sitecore)) // Starting request with "sitecore/"
      || Context.PageMode.IsExperienceEditor || Context.PageMode.IsDebugging || Context.PageMode.IsPreview || Context.User.IsAdministrator;
    }
}

Above code if any CMS specific request then it'll skip using IsCMSRequest() method.

Patch config file

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<httpRequestBegin>
<processor type=”Sitecore.Foundation.Forms.Pipelines.ValidateUserSession, Sitecore.Foundation.Forms” patch:after=”*[@type=’Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel’]”/>
</httpRequestBegin>
</pipelines>
</sitecore>
</configuration>

Kindly let me know if any query.

Answer 2

Sitecore has some out of the box error pages in the webroot below \sitecore\service one of them is the noaccess.aspx

Similar for the 404 not found page you can adjust this in the Sitecore config.

See this setting:

<!--
  ACCESS DENIED HANDLER
            Url of page handling 'Acess denied' errors

--><setting name="NoAccessUrl" value="/sitecore/service/noaccess.aspx"/>

You can adjust the url and/or create some logic to handle this noaccess situation.