2

Security Bulletin SC2017-001-170504 asks us to remove some handlers from CD, but looking at them I'm not sure if any of the others are actually needed. SC V8.2.1

<handlers>
  <add name="WebDAVRoot" path="*" verb="OPTIONS,PROPFIND" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add name="WebDAVRoot64" path="*" verb="OPTIONS,PROPFIND" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" path="sitecore_webDAV.ashx" type="Sitecore.Resources.Media.WebDAVMediaRequestHandler, Sitecore.Kernel" name="Sitecore.WebDAVMediaRequestHandler" />
  <add verb="*" path="sitecore_media.ashx" type="Custom.Handlers.MediaRequestHandler, Custom" name="Sitecore.MediaRequestHandler" />
  <add verb="*" path="sitecore_xaml.ashx" type="Sitecore.Web.UI.XamlSharp.Xaml.XamlPageHandlerFactory, Sitecore.Kernel" name="Sitecore.XamlPageRequestHandler" />
  <add verb="*" path="sitecore_icon.ashx" type="Sitecore.Support.Resources.IconRequestHandler, Sitecore.Support.136135" name="Sitecore.Support.IconRequestHandler" />
  <add verb="*" path="sitecore_temp.ashx" type="Sitecore.Resources.TempRequestHandler, Sitecore.Kernel" name="Sitecore.TempRequestHandler" />
  <add verb="*" path="sitecore_feed.ashx" type="Sitecore.Shell.Feeds.FeedRequestHandler, Sitecore.Kernel" name="Sitecore.FeedRequestHandler" />
  <add verb="*" path="sitecore_handlers.ashx" type="Sitecore.Web.CustomHandlerFactory, Sitecore.Kernel" name="Sitecore.GenericHandler" />
  <add verb="*" path="sitecore_device_simulation.ashx" type="Sitecore.Shell.DeviceSimulation.SimulationRequestHandler, Sitecore.Kernel" name="Sitecore.SimulationRequestHandler" />
  <add name="Telerik_Web_UI_DialogHandler_aspx" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />
  <add name="Telerik_Web_UI_SpellCheckHandler_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.SpellCheckHandler.axd" type="Telerik.Web.UI.SpellCheckHandler" />
  <add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />
  <add name="LoggerHandler" verb="*" path="*.logger" type="JSNLog.LoggerHandler, Sitecore.Logging.Client" resourceType="Unspecified" preCondition="integratedMode" />
  <add name="LoggerHandler-Classic" path="*.logger" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode" />
  <add verb="*" path="*.aspx" type="Sitecore.DependencyInjection.AutowiredPageHandlerFactory, Sitecore.Kernel, Version=8.2.0, Culture=neutral" name="AutowiredPageHandlerFactory" />
  <add verb="*" name="Sitecore.SpeakJS64" path="*/speak/v1/*/*.js" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" name="Sitecore.SpeakJS32" path="*/speak/v1/*/*.js" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add verb="*" name="Sitecore.SpeakClassic64" path="sitecore_speak.ashx" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
  <add verb="*" name="Sitecore.SpeakClassic32" path="sitecore_speak.ashx" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness32" />
  <add verb="*" path="sitecore_speak.ashx" type="Sitecore.Resources.Scripts.ScriptHandler, Sitecore.Speak.Client" name="Sitecore.Speak" />
  <add verb="*" path="sitecore_expeditor_speak_request.ashx" type="Sitecore.ExperienceEditor.Speak.Server.RequestHandler, Sitecore.ExperienceEditor.Speak" name="Sitecore.ExperienceEditor.Speak" />
</handlers>
Improve this question

1 Answer 1

Reset to default
3

You can definitely remove Telerik, Speak, Webdav and other CM side related handlers.

  • WebDAVRoot
  • WebDAVRoot64
  • sitecore_webDAV.ashx
  • sitecore_xaml.ashx
  • sitecore_icon.ashx
  • sitecore_feed.ashx
  • sitecore_handlers.ashx
  • Telerik_Web_UI_DialogHandler_aspx
  • Telerik_Web_UI_SpellCheckHandler_axd
  • Telerik_Web_UI_WebResource_axd
  • Sitecore.SpeakJS64
  • Sitecore.SpeakJS32
  • Sitecore.SpeakClassic64
  • Sitecore.SpeakClassic32
  • sitecore_speak.ashx
  • sitecore_expeditor_speak_request.ashx

also check following link: Limit access to .XML, .XSLT, and .MRT files

Improve this answer
2
  • Hello and welcome to Sitecore Stack Exchange! Your answer is not exhaustive - the OP (original poster) is asking about all of the listed handlers, so your answer should attempt to address every one of them. You can edit your answer to add more detail.
    – Dmytro Shevchenko
    Jul 10, 2017 at 8:03
  • Are you sure about sitecore_icon.ashx ? There has been a few security patches in the past on that and they never mentioned it could be removed from CD.
    – Mark Gibbons
    Jul 11, 2017 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.