I used this before Sitecore 8 to force users to reset their passwords if they are past a certain date. I've been given this task again in Sitecore 8. It looks like the new change password page requires user authentication meaning I cannot invalidate their login. The aspx page I am referring to is located at the following location: webroot/sitecore/shell/Applications/Security/ChangePassword/changepassword.aspx. Is there a different page I should redirect the user?

If not is there a pipeline that I could add a processor to other than httprequestbegin that will do the following:

  1. If a user is logged in with an expired password redirect them to the change password page (unless the current requested page is the change password page)
  2. If page mode is preview mode and the underlying user has an expired password redirect them to the change password page (unless the current requested page is the change password page)

Preview mode seems to be a special case because the context user is extranet\anonymous so I'm not sure if there's a way to fix up that issue. It's such an edge case anyway. The user following this path would need a url to access preview mode but I would like to cover this if possible.

Using: Sitecore 8.2 (rev. 170614)

1 Answer 1


I couldn't find a good way to keep a user who logged in from seeing the preview page. With that being said, here's what I ended up doing:

public class RedirectUserToChangedPassword : HttpRequestProcessor
    private TimeSpan TimeSpanToExpirePassword { get; set; }
    private string ChangePasswordPageUrl { get; set; }

    public override void Process(HttpRequestArgs args)
        if (((Sitecore.Context.PageMode.IsNormal || Sitecore.Context.PageMode.IsPreview)
                && Sitecore.Context.Site != null
                //custom method: IsContentSite
                && Sitecore.Context.Site.IsContentSite())
            || Sitecore.Context.User == null
            || Sitecore.Context.User.IsAdministrator
            || args.Url == null
            || String.Equals(args.Url.FilePath, ChangePasswordPageUrl, StringComparison.CurrentCultureIgnoreCase))

        var membershipUser = Membership.GetUser(Sitecore.Context.User.Name, false);

        if (!HasPasswordExpired(membershipUser))

        var queryString = new NameValueCollection();
        queryString.Add(Constants.Sitecore.ChangePassword.OriginalUrlKey, args.Url.FilePathWithQueryString);

        //custom method: ToQueryString
        WebUtil.Redirect(ChangePasswordPageUrl + (ChangePasswordPageUrl.Contains("?") ? "&" : "?") + queryString.ToQueryString());

    private bool HasPasswordExpired(MembershipUser user)
        return user.LastPasswordChangedDate.Add(TimeSpanToExpirePassword) <= DateTime.Now;


  <configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
          <processor type="MyDll.CustomSitecore.Pipelines.HttpRequest.RedirectUserToChangedPassword, MyDll"
                     patch:after="*[@type='Sitecore.Pipelines.HttpRequest.UserResolver, Sitecore.Kernel']">

From the config you can see that I created a custom change password page. I copied the default one into my project with a new name and had it inherit my own source. The reason I had to do this is that normally this aspx opens in a dialog. After hitting the continue button it is, by default, set up to close the top dialog. Here is my class that customchangepassword.aspx used:

public class ChangePasswordPage : Sitecore.Shell.Applications.Security.ChangePassword.ChangePasswordPage
    protected override void OnLoad(EventArgs e)
        ChangePassword.ContinueButtonClick += ChangePassword_ContinueButtonClick;

    private void ChangePassword_ContinueButtonClick(object sender, EventArgs e)
        Sitecore.Diagnostics.Assert.ArgumentNotNull(sender, "sender");
        Sitecore.Diagnostics.Assert.ArgumentNotNull(e, "e");

        var originalUrl = Request.QueryString[Constants.Sitecore.ChangePassword.OriginalUrlKey];
        if (!originalUrl.IsNullOrEmpty())
        else if (Sitecore.Context.User != null)

I kept the original contents of changepassword.aspx the same other than the very top line. I changed the top line of changepassword.aspx to the following:

<%@ Page Language="c#" AutoEventWireup="True" Inherits="Namespace.To.Custom.Code.ChangePasswordPage" MasterPageFile="~/sitecore/shell/DialogPage.Master" CodeBehind="ChangePassword.aspx.cs" %>

Constants.Sitecore.ChangePassword.OriginalUrlKey was in a constant file and had a value of originalUrl.

  • what is the value in Constants.Sitecore.ChangePassword.OriginalUrlKey and can you please add the code in customchangepassword.aspx page also?
    – Anjo
    Oct 22, 2017 at 14:08
  • @Anjo I updated my answer. Let me know if there are any other questions.
    – Teeknow
    Oct 23, 2017 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.