0

We are working on Sitecore 8.1 instance where we have got a security issue. As per the issue, few media files are getting downloaded directly when we hit the url. Example -

https://hostname/-/media/Themes/subfoldername/fonts/Effra/Effra-Light/Effra-Light.woff

If I hit this url directly on my browser (after replacing hostname and subfoldername), Effra-Light.woff file gets downloaded on my system. Can anybody please suggest how to prevent this behavior?

Extension - woff

Mimetype - application/octet-stream

Update 1 -

enter image description here

2
  • 1
    WOFF files are referenced within CSS files using the @font-face rule, are you using it directly on the browser? Nov 11, 2021 at 9:29
  • Hi @MahendraShekhawat. Thank you for your comment. As shown in the screenshot in the updated question above, we can see woff file in the network tab and initiator is "optimized-min.css". Here if I right click on woff file and click on "open in new tab" option, the file gets downloaded. We are not using it directly on the browser.
    – NewbieHere
    Nov 11, 2021 at 9:38

1 Answer 1

0

If you want to restrict media files not to being downloaded you can set in security editor a certain folder to be "Required Login". In security editor choose a folder from Media Library and click "Required Login" button. This will restrict access to the contents of media folder unless user is logged in.

Also you can break the access for anonymous user by breaking the inheritance for media folder. Anonymous users are the one who is not logged in.

Here is more information about access rights: https://doc.sitecore.com/en/developers/81/sitecore-experience-platform/the-access-rights.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.