Create No Access Page for multi site

Question

I am using sitecore 9.1 with SXA 1.8 , Is there a way to have access denied page for each site in SXA?

Answer 1

Unfortunately you cannot set a 403 (Forbidden) SXA page (just like the 404 and 500). By default, the user will be redirected to the noaccess.aspx page. You can create custom 403 behaviour using a pipeline processor.

Create custom 403 behaviour

Add this config:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
   <sitecore>
      <pipelines>
        <httpRequestBegin>
          <processor type="ErrorHandling.Pipelines.ExecuteRequestProcessor, Foundation.ErrorHandling"
                 patch:before="processor[@type='Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel']" />
        </httpRequestBegin>
      </pipelines>
   </sitecore>
</configuration>

Add a pipeline processor (inherit from the ExecuteRequest processor).

public class ExecuteRequestProcessor : ExecuteRequest
{
    protected override void RedirectOnNoAccess(string url)
    {
        // check whether Sitecore is redirecting to /noaccess.aspx page
        if (!url.StartsWith(this.GetDefaultNoAccessUrl()))
            return;

        // find your custom 403 page
        string forbiddenItemPath = "somepath/to/the/custom/403";
        if (!string.IsNullOrEmpty(forbiddenItemPath))
        {
            var contentUrl = string.Concat(WebUtil.GetServerUrl(), forbiddenItemPath);

            var headers = new System.Collections.Specialized.NameValueCollection();
            if (HttpContext.Current.Request.Headers.Get("Cookie") != null)
            {
                headers.Add("Cookie", HttpContext.Current.Request.Headers.Get("Cookie"));
            }

            // get 403 content with the correct user context (.ASPXAUTH from cookie)
            string content = WebUtil.ExecuteWebPage(contentUrl, headers);

            // set Response params
            HttpContext.Current.Response.TrySkipIisCustomErrors = true;
            HttpContext.Current.Response.StatusCode = 403;
            HttpContext.Current.Response.StatusDescription = "Forbidden";
            HttpContext.Current.Response.Write(content);
            HttpContext.Current.Response.Flush();                

            return;
        }

        base.RedirectOnNoAccess(url);
    }

    private string GetDefaultNoAccessUrl()
    {
        bool loginpage = false;
        return this.GetNoAccessUrl(out loginpage);
    }
}