0

I am using sitecore 9.1 with SXA 1.8 , Is there a way to have access denied page for each site in SXA?

1

1 Answer 1

3

Unfortunately you cannot set a 403 (Forbidden) SXA page (just like the 404 and 500). By default, the user will be redirected to the noaccess.aspx page. You can create custom 403 behaviour using a pipeline processor.

Create custom 403 behaviour

Add this config:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
   <sitecore>
      <pipelines>
        <httpRequestBegin>
          <processor type="ErrorHandling.Pipelines.ExecuteRequestProcessor, Foundation.ErrorHandling"
                 patch:before="processor[@type='Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel']" />
        </httpRequestBegin>
      </pipelines>
   </sitecore>
</configuration>

Add a pipeline processor (inherit from the ExecuteRequest processor).

public class ExecuteRequestProcessor : ExecuteRequest
{
    protected override void RedirectOnNoAccess(string url)
    {
        // check whether Sitecore is redirecting to /noaccess.aspx page
        if (!url.StartsWith(this.GetDefaultNoAccessUrl()))
            return;

        // find your custom 403 page
        string forbiddenItemPath = "somepath/to/the/custom/403";
        if (!string.IsNullOrEmpty(forbiddenItemPath))
        {
            var contentUrl = string.Concat(WebUtil.GetServerUrl(), forbiddenItemPath);

            var headers = new System.Collections.Specialized.NameValueCollection();
            if (HttpContext.Current.Request.Headers.Get("Cookie") != null)
            {
                headers.Add("Cookie", HttpContext.Current.Request.Headers.Get("Cookie"));
            }

            // get 403 content with the correct user context (.ASPXAUTH from cookie)
            string content = WebUtil.ExecuteWebPage(contentUrl, headers);

            // set Response params
            HttpContext.Current.Response.TrySkipIisCustomErrors = true;
            HttpContext.Current.Response.StatusCode = 403;
            HttpContext.Current.Response.StatusDescription = "Forbidden";
            HttpContext.Current.Response.Write(content);
            HttpContext.Current.Response.Flush();                

            return;
        }

        base.RedirectOnNoAccess(url);
    }

    private string GetDefaultNoAccessUrl()
    {
        bool loginpage = false;
        return this.GetNoAccessUrl(out loginpage);
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.