Currently, when a logged in user tries to access a page that they do not have permission to (because they don't have a certain role), Sitecore seems to redirect the user to the login page.

This is obviously confusing to the user as they are already logged in - I'd like to show a 401 page instead.

1 Answer 1



When the ItemResolver processor executes, it determines the context item for the request based on the current URL. Additionally, it also performs a security check to see if the current user can access that item. If they can't, the context item is cleared and a PermissionDenied property on HttpRequestArgs is set to true.

When the ExecuteRequest processor executes, the PermissionDenied property is inspected and this is where Sitecore decides to redirect the user to the login page if one has been specified for the site. It does not determine if the user is already logged in or not when doing so, hence your problem.


You can achieve what you want by adding a pipeline step in-between the ItemResolver and ExecuteRequest processors in the httpRequestBegin pipeline:

public class PermissionDeniedResolver : HttpRequestProcessor
    public override void Process(HttpRequestArgs args)
        Assert.ArgumentNotNull((object) args, "args");

        if (args.PermissionDenied && UserIsLoggedIn(Sitecore.Context.User)
            // Redirect to your permission denied page here

    private bool UserIsLoggedIn(Account user)
        // Perform your logged in test here, e.g:
        return user.IsAuthenticated;

This can then be patched to execute after the Item resolver:

<processor type="MyProject.Pipelines.HttpRequest.PermissionDeniedResolver, MyProject"
patch:after="*[@type='Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel']"/>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.