I have requirement of exposing Sitecore CMS site through gateway url. Gateway is setup properly and gateway url has been updated in TargetHostName and identityServerAuthority in sitecore config.

But when we try to login with Gateway CM url, after user login, page getting redirect back to login page of internal cm url.

Error stack on log:

10620 02:32:37 ERROR Application error.
Exception: System.Web.HttpUnhandledException
Message: Exception of type 'System.Web.HttpUnhandledException' was thrown.
Source: System.Web
   at System.Web.UI.Page.HandleError(Exception e)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Nested Exception

Exception: System.Reflection.TargetInvocationException
Message: Exception has been thrown by the target of an invocation.
Source: mscorlib
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Sitecore.Reflection.ReflectionUtil.InvokeMethod(MethodInfo method, Object[] parameters, Object obj)
   at Sitecore.Nexus.Pipelines.NexusPipelineApi.Resume(PipelineArgs args, Pipeline pipeline)
   at Sitecore.Pipelines.Pipeline.Start(PipelineArgs args, Boolean atomic)
   at Sitecore.sitecore.login.Default.LoggedIn()
   at Sitecore.sitecore.login.Default.LoginClicked(Object sender, EventArgs e)
   at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
   at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Nested Exception

Exception: Sitecore.Exceptions.SecurityException
Message: Only local URLs are allowed.
Source: Sitecore.Kernel
   at Sitecore.Web.Authentication.DefaultTicketManager.CheckOnExternalUrl(String startUrl)
   at Sitecore.Web.Authentication.DefaultTicketManager.CreateTicket(String userName, String startUrl, Boolean persist)
   at Sitecore.Pipelines.LoggedIn.Ticket.Process(LoggedInArgs args)

9224 02:32:38 WARN  Request is redirected to login page. Requested url: /sitecore/client/Applications/Launchpad?sc_lang=en, User: sitecore\Anonymous, Website: shell
14196 02:32:39 INFO  HttpModule is being initialized 

Any suggestion would be appreciated to fix this issue.

NOTE: We are disabled the IS, we are not using it. Sitecore version: 10.2

  • Have you updated the CMS public URL to the identityserver configuration: SC101.identityserver\Config\production\Sitecore.IdentityServer.Host.xml --------- Configuraiton: -------------------- <DefaultClient> <AllowedCorsOrigins> <AllowedCorsOriginsGroup1>SC101.sc</AllowedCorsOriginsGroup1> </AllowedCorsOrigins> </DefaultClient>
    – Jitendra
    Commented Aug 26, 2022 at 4:45
  • @Jitendra We are not using identity server.
    – Bharath
    Commented Aug 26, 2022 at 4:54
  • After final redirect to local login, if you then go to https://<applicationURL>/sitecore/client/Applications/Launchpad?sc_lang=en what happens? Commented Aug 26, 2022 at 18:48
  • Also, when you access user manager -> edit user -> profile. Is there a value for URL on user profile specified? If so please what does it read? Commented Aug 26, 2022 at 19:29
  • @DeanOBrien user profile is set to deafult. And when user login, post successful login in gateway url, the launchpad redirection is happing to internal Launchpad url, since on internal url user login was not happen, however user is taken back to internal login page with 303 error on console. Same behaviour has been observed when I try to login through OKTA SSO federated auth on CM.
    – Bharath
    Commented Aug 28, 2022 at 23:57

2 Answers 2


Sitecore has a ApplyRedirect pipeline. You can find it in Sitecore.Owin.Authentication.dll with the full namespace Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.ApplyRedirect.

In there is the following line:

args.Context.Options.Provider.ApplyRedirect(new CookieApplyRedirectContext(args.Context.OwinContext, args.Context.Options, args.StartUrl));

The value of the args.StartUrl is HttpContext.Current.Request.Url.AbsoluteUri. This means that it always redirects to current server URL and ignores the gateway URL. I fixed it by replacing the ApplyRedirect with my own:

public class ApplyRedirect : SignedInProcessor
    private IEnumerable<PathString> _loginPaths;

    private readonly IUrlUtils urlUtils;

    private readonly ISitesContext sitesContext;

    public ApplyRedirect(BaseSettings settings, ISitesContext sitesContext, IUrlUtils urlUtils)
        Assert.ArgumentNotNull(settings, nameof(settings));
        this.Settings = settings;

        this.sitesContext = sitesContext;
        this.urlUtils = urlUtils;

    protected BaseSettings Settings { get; }

    private IEnumerable<PathString> LoginPaths => _loginPaths ??= GetLoginPaths();

    public override void Process(SignedInArgs args)
        Assert.ArgumentNotNull(args, nameof (args));
        if (string.IsNullOrWhiteSpace(args.StartUrl))

        var url = args.Context.Request.Query.Get(args.Context.Options.ReturnUrlParameter);
        if (!string.IsNullOrWhiteSpace(url)
            && args.Context.Request.Path == args.Context.Options.LoginPath
            && !WebUtil.IsExternalUrl(url, args.Context.Request.Host.Value)
            && args.Context.Response.StatusCode == 200
            || !this.LoginPaths.Any(args.Context.OwinContext.Request.Path.StartsWithSegments))

        var domain = urlUtils.GetDomain();

        var redirectUri = WebUtil.GetUri(url ?? "/", new Uri(domain));

        args.Context.Options.Provider.ApplyRedirect(new CookieApplyRedirectContext(

    private List<PathString> GetLoginPaths()
        return this.sitesContext.GetSites()
            .Select(info => info.LoginPage)
            .Where(s => !string.IsNullOrWhiteSpace(s)).Concat(
                    this.Settings.IdentityProcessingPathPrefix().EnsureTrailingSlash() + "externallogincallback",
                    this.Settings.IdentityProcessingPathPrefix().EnsureTrailingSlash() + "loginpassword"
                }).Select(s =>
                    return new PathString(s);
                catch (ArgumentException)
                    throw new ArgumentException("Login page must start with '/'");

This version is a copy of the Sitecore version, but it gets the domain from a helper. In our helper we check for certain headers that the gateway sends. One of those headers is the gateway domain. If we find that we use that instead of the webserver domain.

You can replace the Sitecore pipeline with your own with this config transform:

<processor type="Project.Foundation.Identity.Pipelines.ApplyRedirect, Project.Foundation.Identity" resolve="true" patch:instead="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.ApplyRedirect, Sitecore.Owin.Authentication']" />

Now that you have your custom ApplyRedirect it should redirect to the gateway domain.

  • Thanks for your suggestion @Jeroen , we have setup custom domain to sort out this issue. We got to know from Sitecore documentation that gateway doesn't work for CM with sitecore default configuration. I'm glad to see your custom code to fix my issue. thanks for it.
    – Bharath
    Commented Oct 6, 2022 at 1:29

According to our documentation Azure Application Gateway is not supported on CM instances:

https://doc.sitecore.com/xp/en/developers/102/sitecore-experience-manager/using-azure-application-gateway-to-secure-your-content-delivery-server.html (WAF and Application Gateway are compatible with CDs, they are not compatible with Content Management (CM))

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0682999#Notes (WAF and Application Gateway are compatible with Content Delivery (CD) servers, they are not compatible with Content Management (CM) servers.)

Solution: We have fixed this issue by setup a custom domain for CM site.

  • I also faced the similar issue and we implemented the same fixed mentioned above and it worked for us too. Commented Sep 13, 2023 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.