"security: "require"="sitecore" in sitecore config

Question

What does "security: "require" in sitecore configuration mean?

<sitecore role:require="Standalone or ContentManagement" security:require="Sitecore">

Does it mean access to sitecore or user should be in Sitecore domain?

Answer 1

In the web config you will find security:define configuration which explain security definition:

   <!-- SUPPORTED MEMBERSHIP CONFIGURATION FOR CONTENT DELIVERY
         Specify the membership configuration that you want this server to use for Content Delivery role. The supported options are:

         Sitecore
         None
          
    Default value: Sitecore
    -->
    <add key="security:define" value="Sitecore" />

Answer 2

As per my findings, the security:require attribute in the configuration indicates if security is enforced when accessing items. It typically specifies that certain security conditions must be met for the associated functionality to be accessible or executed. This ensure that only users with the appropriate permissions can execute this pipeline or processor.

Here are some examples.

 <securityEnabled security:require="Sitecore">true</securityEnabled>
 <securityEnabled security:require="None">false</securityEnabled>

Hope this helps.

Answer 3

It does not mean accessing the Sitecore or Sitecore domain.

Sitecore uses the Security database to store security information. The Security database is by default part of the Core database but it can be separated into a stand-alone database. The Content Delivery (CD) instance uses the security connection string to communicate with the Security database whether it is part of the Core database or a stand-alone database.

You can disable the Security database on your CD instances if they do not need user authentication, and you want to keep them as small-scale as possible.

If the Federated Experience Manager (FXM) is being used, do not disable the Security database on the CD instance.

If your site not using Federated authentication, ASP.NET Membership authentication you can set it to None.

Refer more details :Disable the Security database on a Content Delivery instance

Hope it helps!