3

We have configured Sitecore security on items for the roles and seeing the sensitive data in the browser logs. We have a custom error page which interrogates the return codes(403/404/ or any other) and redirect to an item. For Ex: Assume two roles : Admin and customer.

If there are two items:

Item1 - Admin and Customer have read access
Item2 - Only Admin has access

When customer tries to access Item2 then Sitecore is redirecting to 403 as expected and the browser url is https://mywebsite.com/error.aspx?code=403. However when I see the browser network tab I see this : https://mywebsite.com/error.aspx?code=403&item=2fitemname&user=username&site=sitename

Is there any way to hide the highlighted information(item/user/site)?

  • can you try using <setting name="RequestErrors.UseServerSideRedirect" value="true"/> and see if that fixes your issue? I don't have a Sitecore running now to check if it works – Andrey Bobrov Nov 15 '16 at 14:48
  • @adb : Thanks for getting back. I tried the above setting and it completely turns off Sitecore routing. I still want to use Sitecore redirect mechanism except I want to find a way to exclude all the additional parameters(like user, site) that Sitecore is adding. – Vamshi Nov 15 '16 at 15:00
  • Then probably you have to override the default sitecore logic for redirrects. Check this blog post: community.sitecore.net/technical_blogs/b/sitecorejohn_blog/… – Andrey Bobrov Nov 16 '16 at 2:00
6

I was able to find the processor(Sitecore.Pipelines.HttpRequest.ExecuteRequest in Sitecore.Kernel) which adds these query strings and they are not configurable. To fix the issue I created a new class(CustomExecureRequest) and copied the processor and removed the query strings from HandleSiteAccessDenied, HandleItemNotFound and other methods. I then created a patch xml file inside include folder similar to below:

 <sitecore>
    <pipelines>
    <httpRequestBegin>
    <processor patch:instead="processor[@type='Sitecore.Pipelines.HttpRequest.ExecuteRequest, Sitecore.Kernel']" type="YOUR CUSTOM CLASS TYPE, YOUR ASSEMBLY NAME" />
    </httpRequestBegin>
    </pipelines>
    </sitecore>

Hope this helps some one!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.