Any known way to hide Sitecore sensitive data

Question

We have configured Sitecore security on items for the roles and seeing the sensitive data in the browser logs. We have a custom error page which interrogates the return codes(403/404/ or any other) and redirect to an item. For Ex: Assume two roles : Admin and customer.

If there are two items:

Item1 - Admin and Customer have read access
Item2 - Only Admin has access

When customer tries to access Item2 then Sitecore is redirecting to 403 as expected and the browser url is https://mywebsite.com/error.aspx?code=403. However when I see the browser network tab I see this : https://mywebsite.com/error.aspx?code=403&item=2fitemname&user=username&site=sitename

Is there any way to hide the highlighted information(item/user/site)?

Answer 1

I was able to find the processor(Sitecore.Pipelines.HttpRequest.ExecuteRequest in Sitecore.Kernel) which adds these query strings and they are not configurable. To fix the issue I created a new class(CustomExecureRequest) and copied the processor and removed the query strings from HandleSiteAccessDenied, HandleItemNotFound and other methods. I then created a patch xml file inside include folder similar to below:

 <sitecore>
    <pipelines>
    <httpRequestBegin>
    <processor patch:instead="processor[@type='Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel']" type="YOUR CUSTOM CLASS TYPE, YOUR ASSEMBLY NAME" />
    </httpRequestBegin>
    </pipelines>
    </sitecore>

Hope this helps some one!