How do you restrict media from serving up on different domains in SXA?

Question

Let's say for example we have two SXA websites.

• AwesomeSauce.com
• TheBomb.com

If an image appears on one domain, I can access it using the other domain.

https://www.awesomesauce.com/-/media/project/awesome/sauce/usa/images/hero.jpg?
https://www.thebomb.com/-/media/project/awesome/sauce/usa/images/hero.jpg?

Is there a way to restrict the tenant content to a specific domain?

Answer 1

What about doing this with domains and security.

You can setup domains for your sites - let's call them awesomesource and thebomb.

Then in your media library, deny access to the sections specific for each site to the other sites domain anonymous user.

So on the /sitecore/media library/project/awesome/sauce/ deny access to thebomb\anonymous and vice versa on /sitecore/media library/project/the/bomb/ for awesomesource\anonymous.

It would not stop content editors from selecting the wrong image. But it would then give a 401 error. You could also customize that to generate a 404 error.

Answer 2

There is no such concept in Sitecore and, I suspect, no such concept in SXA. But here's how I would approach it (generally speaking):

• add a new custom attribute to your <site> definitions; like mediaRoot="/sitecore/media library/awesomesauce" and mediaRoot="/sitecore/media library/thebomb"
• Using existing handling for 404 of Media Items (found elsewhere on this site), expand that with a check for the image being served. If the image is not .IsDescendantOf the mediaRoot you defined, 404 it
• Profit in powerful ways

Reference: How do you setup a 404 and 500 error page for missing files and media items?

Caveat: There would be no UI support. Likely you would need to consider something like a custom image field validator or so - but even so, the Information Model in Sitecore does not easily lend itself to this approach. Who is to tell, whether a datasource item living somewhere in shared space, will be presented on Site A or Site B.