2

Security Bulletin SC2017-001-170504 asks us to remove some handlers from CD, but looking at them I'm not sure if any of the others are actually needed. SC V8.2.1

<handlers>
  <add name="WebDAVRoot" path="*" verb="OPTIONS,PROPFIND" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add name="WebDAVRoot64" path="*" verb="OPTIONS,PROPFIND" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" path="sitecore_webDAV.ashx" type="Sitecore.Resources.Media.WebDAVMediaRequestHandler, Sitecore.Kernel" name="Sitecore.WebDAVMediaRequestHandler" />
  <add verb="*" path="sitecore_media.ashx" type="Custom.Handlers.MediaRequestHandler, Custom" name="Sitecore.MediaRequestHandler" />
  <add verb="*" path="sitecore_xaml.ashx" type="Sitecore.Web.UI.XamlSharp.Xaml.XamlPageHandlerFactory, Sitecore.Kernel" name="Sitecore.XamlPageRequestHandler" />
  <add verb="*" path="sitecore_icon.ashx" type="Sitecore.Support.Resources.IconRequestHandler, Sitecore.Support.136135" name="Sitecore.Support.IconRequestHandler" />
  <add verb="*" path="sitecore_temp.ashx" type="Sitecore.Resources.TempRequestHandler, Sitecore.Kernel" name="Sitecore.TempRequestHandler" />
  <add verb="*" path="sitecore_feed.ashx" type="Sitecore.Shell.Feeds.FeedRequestHandler, Sitecore.Kernel" name="Sitecore.FeedRequestHandler" />
  <add verb="*" path="sitecore_handlers.ashx" type="Sitecore.Web.CustomHandlerFactory, Sitecore.Kernel" name="Sitecore.GenericHandler" />
  <add verb="*" path="sitecore_device_simulation.ashx" type="Sitecore.Shell.DeviceSimulation.SimulationRequestHandler, Sitecore.Kernel" name="Sitecore.SimulationRequestHandler" />
  <add name="Telerik_Web_UI_DialogHandler_aspx" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />
  <add name="Telerik_Web_UI_SpellCheckHandler_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.SpellCheckHandler.axd" type="Telerik.Web.UI.SpellCheckHandler" />
  <add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />
  <add name="LoggerHandler" verb="*" path="*.logger" type="JSNLog.LoggerHandler, Sitecore.Logging.Client" resourceType="Unspecified" preCondition="integratedMode" />
  <add name="LoggerHandler-Classic" path="*.logger" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode" />
  <add verb="*" path="*.aspx" type="Sitecore.DependencyInjection.AutowiredPageHandlerFactory, Sitecore.Kernel, Version=8.2.0, Culture=neutral" name="AutowiredPageHandlerFactory" />
  <add verb="*" name="Sitecore.SpeakJS64" path="*/speak/v1/*/*.js" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" name="Sitecore.SpeakJS32" path="*/speak/v1/*/*.js" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add verb="*" name="Sitecore.SpeakClassic64" path="sitecore_speak.ashx" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" name="Sitecore.SpeakClassic32" path="sitecore_speak.ashx" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add verb="*" path="sitecore_speak.ashx" type="Sitecore.Resources.Scripts.ScriptHandler, Sitecore.Speak.Client" name="Sitecore.Speak" />
  <add verb="*" path="sitecore_expeditor_speak_request.ashx" type="Sitecore.ExperienceEditor.Speak.Server.RequestHandler, Sitecore.ExperienceEditor.Speak" name="Sitecore.ExperienceEditor.Speak" />
</handlers>
3

You can definitely remove Telerik, Speak, Webdav and other CM side related handlers.

  • WebDAVRoot
  • WebDAVRoot64
  • sitecore_webDAV.ashx
  • sitecore_xaml.ashx
  • sitecore_icon.ashx
  • sitecore_feed.ashx
  • sitecore_handlers.ashx
  • Telerik_Web_UI_DialogHandler_aspx
  • Telerik_Web_UI_SpellCheckHandler_axd
  • Telerik_Web_UI_WebResource_axd
  • Sitecore.SpeakJS64
  • Sitecore.SpeakJS32
  • Sitecore.SpeakClassic64
  • Sitecore.SpeakClassic32
  • sitecore_speak.ashx
  • sitecore_expeditor_speak_request.ashx

also check following link: Limit access to .XML, .XSLT, and .MRT files

  • Hello and welcome to Sitecore Stack Exchange! Your answer is not exhaustive - the OP (original poster) is asking about all of the listed handlers, so your answer should attempt to address every one of them. You can edit your answer to add more detail. – Dmytro Shevchenko Jul 10 '17 at 8:03
  • Are you sure about sitecore_icon.ashx ? There has been a few security patches in the past on that and they never mentioned it could be removed from CD. – Mark Gibbons Jul 11 '17 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.