7

I have set up some Sitecore extranet users (8.1.160519). I am using MVC AntiForgeryTokens for some posts. The problem is with the login form explicitly. When I am developing I am logged in as Admin and as one of my extrant users. If I log in as the Admin first, then try to login as my extranet user I get:

The provided anti-forgery token was meant for user "sitecore\admin", but the current user is "extranet\eschofer".

I am tempted to turn off the AntiForgeryToken for the login form, but would prefer to try and mitigate this.

I already tried setting:

AntiForgeryConfig.SuppressIdentityHeuristicChecks = true;

I am not sure I have this in the correct place in the Pipeline but at least right now it has no effect. Here is where it currently exists in the initialize pipeline:

<initialize>
<processor type="Sitecore.Pipelines.Loader.ShowVersion, Sitecore.Kernel">
<processor type="Sitecore.Analytics.Pipelines.Initialize.ShowXdbInfo, Sitecore.Analytics" patch:source="Sitecore.Xdb.config" />
<processor type="Sitecore.Pipelines.Loader.ShowHistory, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.SetGlobals, Sitecore.Kernel" />
<processor type="Sitecore.Eventing.Remote.RemoteEventMap, Sitecore.Kernel" method="InitializeFromPipeline" />
<processor type="Sitecore.Pipelines.Loader.LoadHooks, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeManagers, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeScheduler, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeHeartbeat, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeAgilityPack, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.EnsureAnonymousUsers, Sitecore.Kernel" />
<!-- Processor checks the WebDAV feature configuration on first start. -->
<processor type="Sitecore.Pipelines.Loader.CheckWebDAVConfiguration, Sitecore.Kernel" patch:source="Sitecore.WebDAV.config" />

###### HERE IS MY PATCH FILE ########    

<processor type="DD.Framework.Pipelines.Initialize.InitializeAntiForgeryTokens, DD.Framework" patch:source="Delphic.InitializeAntiForgeryToken.config" />   

#######################################
<!--
Replaces the default MediaManager.Cache implementation with one that optimizes images on the way to cache
-->
<processor type="Dianoga.Pipelines.Initialize.MediaCacheReplacer, Dianoga" patch:source="Dianoga.config" />
<processor type="DelawareNorth.App_Start.GlassMapperSc, DelawareNorth" patch:source="Glass.Mapper.Sc.Start.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeAutomation,Sitecore.Analytics.Automation" patch:source="Sitecore.Analytics.Automation.TimeoutProcessing.config" />
<processor type="Sitecore.Analytics.Outcome.Pipelines.Initialize.RegisterDataModelExtensions, Sitecore.Analytics.Outcome" patch:source="Sitecore.Analytics.Outcome.config" />
<processor type="Sitecore.Analytics.Automation.Pipelines.Initialize.RegisterDataModelExtensions, Sitecore.Analytics.Automation.MongoDB" patch:source="Sitecore.Analytics.Processing.Aggregation.ProcessingPools.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeTracking, Sitecore.Analytics" patch:source="Sitecore.Analytics.Tracking.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeAnalytics, Sitecore.Analytics" patch:source="Sitecore.Analytics.Tracking.config" />
<processor type="Sitecore.Apps.TagInjection.Loader.TagInjectionInitializer, Sitecore.Apps.TagInjection" patch:source="Sitecore.Apps.TagInjection.config" />
<processor type="Sitecore.Commerce.Pipelines.RegisterConnectTypesWithMongo, Sitecore.Commerce" patch:source="Sitecore.Commerce.config" />
<!--
DUMP CONFIGURATION FILES Dumps the specified configuration files and allows you to monitor all the changes that are made to the configuration files. Supported child nodes: DumpFolder: The path to the root folder where the config file dump is stored. Each config file dump is stored in a folder or a zip archive. The name of the folder or zip archive has the following format: {date}.{time}. Default value: $(dataFolder)/diagnostics/configuration_history Zip: Boolean value that determines whether each dump should be zipped. Default value: true files: Contains <file> nodes where the "path" attribute value is the path to the configuration file or the folder that should be dumped.
-->
<processor type="Sitecore.Pipelines.Loader.DumpConfigurationFiles, Sitecore.Kernel" patch:source="Sitecore.Diagnostics.config">
<processor type="Sitecore.Pipelines.Loader.InitializeJSNLog, Sitecore.Kernel" patch:source="Sitecore.JSNLog.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeGlobalFilters, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeControllerFactory, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<processor type="Sitecore.Mvc.Pipelines.Initialize.InitializeCommandRoute, Sitecore.Speak.Mvc" patch:source="Sitecore.Speak.Mvc.config" />
<processor type="Sitecore.ContentTesting.Pipelines.Initialize.RegisterWebApiRoutes, Sitecore.ContentTesting" patch:source="Sitecore.ContentTesting.config" />
<!-- Processor initializes the "Social" MVC area. -->
<processor type="Sitecore.Social.Client.Mvc.Pipelines.Initialize.RegisterSocialArea, Sitecore.Social.Client.Mvc" patch:source="Sitecore.Social.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeRoutes, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<!--
One-time run code that synchronizes a segment if it's workflow state is 'Deployed' but non-existent in db, with DeployDate = UTC.NOW
-->
<processor type="Sitecore.ExperienceAnalytics.Client.Deployment.SyncSegmentsProcessor, Sitecore.ExperienceAnalytics.Client" patch:source="Sitecore.ExperienceAnalytics.Client.config">
<!-- Initializing Experience Analytics Web API -->
<processor type="Sitecore.ExperienceAnalytics.Api.Pipelines.Initialize.WebApiInitializer, Sitecore.ExperienceAnalytics" patch:source="Sitecore.ExperienceAnalytics.WebAPI.config">
 <!-- Creates client specific http endpoints. -->
<processor type="Sitecore.Cintel.Client.Initialization.InitializeRoutes, Sitecore.Cintel.Client" patch:source="Sitecore.ExperienceProfile.Client.config" />
<!-- Creates a set of http endpoints that expose functionality of Experience Profile. -->
<processor type="Sitecore.Cintel.Endpoint.Plumbing.InitializeRoutes, Sitecore.Cintel" patch:source="Sitecore.ExperienceProfile.config" />
<!--
Maps a specific route for the Beacon Service to allow session state to be enabled as the DMS relies upon the existence of a session.
-->
<processor type="Sitecore.FXM.Service.Pipelines.EnableBeaconServiceSessionStateProcessor, Sitecore.FXM.Service" patch:source="Sitecore.FXM.config" />
<processor type="Delphic.Sitecore.Particle.Pipeline.ParticleStart, Delphic.Sitecore.Particle" patch:source="Particle.config" />
<!-- Processor maps remote events. -->
<processor type="Sitecore.Social.Client.Pipelines.Initialize.RemoteEventMap, Sitecore.Social.Client" patch:source="Sitecore.Social.config" />
</initialize>
7

Use two browsers: when logged in as sitecore\admin and extranet\xxx might break other things as well. Use a chrome-browser and incognito window to truly have a visitor experience. This is better from a security perspective as well.

  • Is there a way I can make this gracefully fail? For example - "You are already logged in, please log out!" or something? – Ethan Schofer Dec 21 '16 at 19:26
  • 1
    I would use a pipeline for that one, to check if you are logged in into the right domain – Bas Lijten Dec 21 '16 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.