4

I installed a vanilla Sitecore 8.2.5 instance and revoked read access on Home page to extranet/anonymous user. I logged out from the shell site and hit the home page and I am still able to access it !

Is that the normal behaviour or a bug in Sitecore ? If it's the normal behaviour then how can I secure a page from being accessed by anonymous users ?

Improve this question
3
  • 1
    Did you verify the security setting with the access viewer?
    – Gatogordo
    Commented Dec 17, 2017 at 13:04
  • 2
    Have you published the home item after applying the security?
    – Artem Prashkovich
    Commented Dec 17, 2017 at 13:09
  • Thanks Artsem, I forgot to publish as I am working on another instance which points to master. Now, I published and I am getting the following "The requested document was not found" instead of access denied
    – Arsany
    Commented Dec 18, 2017 at 3:58

2 Answers 2

Reset to default
2

This is a bug in Sitecore 8.2 update 5. It has been fixed in update 6 according to the release notes.

https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/82/Sitecore%20Experience%20Platform%2082%20Update6/Release%20Notes

A hotfix might be available from Sitecore Support with the number 183497.

Improve this answer
1

As @Artsem mentioned, please check if your home node is published or not, but in general here are the steps to secure home node for extranet/anonymous users.

1) Go to security editor and revoke read access for home node for extranet/anonymous user.

2) Go to access viewer and make sure that the permissions are added properly.

3) As @Artsem mentioned, please publish home node.

4) Your home page is secured now.

Please follow the steps, and let me know if this helps.

Thanks,

Improve this answer
3
  • Thanks Ankit, now, I published and I am getting the following "The requested document was not found" instead of access denied
    – Arsany
    Commented Dec 18, 2017 at 3:59
  • @Arsany- can you mark this answer as accepted, if this works for you?
    – Ankit Joshi
    Commented Dec 18, 2017 at 4:21
  • While a 404 effectively prevents unauthirozed access it is certainly strange that Sitecore decides to return this status code instead of 403 (access denied). I have the very same problem after an upgrade to 8.2.5 from 7.5.
    – Jan Löwgren
    Commented Dec 18, 2017 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.