I am using sitecore 9.1 with SXA 1.8 , Is there a way to have access denied page for each site in SXA?
1 Answer
Unfortunately you cannot set a 403 (Forbidden) SXA page (just like the 404 and 500). By default, the user will be redirected to the noaccess.aspx page. You can create custom 403 behaviour using a pipeline processor.
Create custom 403 behaviour
Add this config:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<httpRequestBegin>
<processor type="ErrorHandling.Pipelines.ExecuteRequestProcessor, Foundation.ErrorHandling"
patch:before="processor[@type='Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel']" />
</httpRequestBegin>
</pipelines>
</sitecore>
</configuration>
Add a pipeline processor (inherit from the ExecuteRequest processor).
public class ExecuteRequestProcessor : ExecuteRequest
{
protected override void RedirectOnNoAccess(string url)
{
// check whether Sitecore is redirecting to /noaccess.aspx page
if (!url.StartsWith(this.GetDefaultNoAccessUrl()))
return;
// find your custom 403 page
string forbiddenItemPath = "somepath/to/the/custom/403";
if (!string.IsNullOrEmpty(forbiddenItemPath))
{
var contentUrl = string.Concat(WebUtil.GetServerUrl(), forbiddenItemPath);
var headers = new System.Collections.Specialized.NameValueCollection();
if (HttpContext.Current.Request.Headers.Get("Cookie") != null)
{
headers.Add("Cookie", HttpContext.Current.Request.Headers.Get("Cookie"));
}
// get 403 content with the correct user context (.ASPXAUTH from cookie)
string content = WebUtil.ExecuteWebPage(contentUrl, headers);
// set Response params
HttpContext.Current.Response.TrySkipIisCustomErrors = true;
HttpContext.Current.Response.StatusCode = 403;
HttpContext.Current.Response.StatusDescription = "Forbidden";
HttpContext.Current.Response.Write(content);
HttpContext.Current.Response.Flush();
return;
}
base.RedirectOnNoAccess(url);
}
private string GetDefaultNoAccessUrl()
{
bool loginpage = false;
return this.GetNoAccessUrl(out loginpage);
}
}