Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

Hide content item [on hold]

While working on a Sitecore 9 SXA project I want to hide a content section item called ‘Custom Metadata’ for a specific role. I tried to Hide section from the security tab and edit the Role manager ...
4
votes
2answers
58 views

JSS layout service, how to restrict public access

I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API. Please note, I am not taking about the login/logout ...
1
vote
1answer
47 views

Login virtual user to Sitecore Content Editor

Sitecore 8.2 I need to login virtual user with name like 'virtualUser2000' (not 'sitecore\virtualUser2000') to sitecore content editor. My code: var virtualUser = _authenticationManager....
2
votes
1answer
26 views

What are the consequences of an item locked in the web database?

While reviewing if an item was published in the Web database, I noticed some items showed the locked gutter icon. Is there a change in behavior with respect to viewing the published site if an item ...
0
votes
1answer
74 views

Writing an IIS rewrite rule for the Sitecore control panel URL

If I try to access http://mydomain.com/sitecore I get a 403 error. I would instead prefer for IIS to automatically redirect to https://mydomain.com/sitecore. I added the following rule in ...
2
votes
2answers
53 views

Securing the Sitecore client on a single server setup with CDN

On a single server setup for Sitecore which has a CDN in front of it how would you go about securing the Sitecore client. If there was no CDN I would implement IP security to block access to the ...
1
vote
1answer
59 views

Sitecore 9.2 Virtual User Authentication and SessionId Cookie

On the project I'm working on, we have chosen to use Sitecore 9.2 XM with Identity Server disabled. Where in the pipeline should I expect to see the ASP.NET_SessionId cookie get generated to be sent ...
1
vote
1answer
39 views

What happens when you change the security domain setting for a site?

I was going through Sitecore domains documentation and found the link interesting. https://www.linkedin.com/pulse/what-importance-security-domains-sitecore-rohit-chopra Upon going through that, I ...
0
votes
0answers
39 views

Allowing custom role to move items

So according to this article it was a case of jumping into the Core database and setting read and write permissions on the Move To item. https://community.sitecore.net/developers/f/8/t/3976 ...
0
votes
1answer
33 views

Sitecore role in site1 when installed to site2, missing some restrictions in site2

For the new developer role we restricted access to Development tools in source site.When this role is packaged and installed in target site, it has permission to Development tools. How do we fix this ...
1
vote
1answer
37 views

Content and Experience Editor custom buttons - only show for certain roles

I've added a couple of custom buttons on the Publish Chunks of the Content and Experience Editors Publish Strips. Right now, these custom buttons show for everyone, but I only want them to show up for ...
1
vote
2answers
48 views

Can I safely disable HTTP methods DELETE and OPTIONS?

A recent security audit recommended that I disable the HTTP methods DELETE and OPTIONS. I am not opposed to doing this, but have been unable to find any documentation indicating that I can do so ...
0
votes
2answers
108 views

Access to Sitecore CM from outside network

Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page? My client wants to make content management available to external agencies (who are comfortable ...
2
votes
2answers
109 views

Check if a user is disabled

We have some custom code to send emails out when submitting an item from one workflow state to another and it seems to be sending items to users who have been disabled. I've been trying to find a way ...
0
votes
2answers
101 views

Sitecore API key shown in Network tab

As you can see in the image above, the API key is clearly visible to all people to see. If you simply follow the URL you get the message: { "errors": [ { "message": "No query ...
3
votes
1answer
136 views

Checklist for Sitecore Security Hardening using Azure PaaS

I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link - https://doc.sitecore.com/...
1
vote
1answer
42 views

Content authors to see their own items only in workbox, not from other authors

Is there a way to implement the workflow and user roles for Content authors to see their own items only in workbox not from other authors.
0
votes
1answer
51 views

How to define a new user role that can create and approve their OWN content only?

I have a requirement like a user should create and approve their OWN content only and it should not accessible that created/updated Sitecore items to other users. Ex: user1 has created a test1 page ...
0
votes
0answers
32 views

Faking user roles / Temporarily assign roles to the user

I have a requirement like I need to add temporary roles to the user (hope we have to try it on loggingin or loggedin pipeline) and the roles should not be persisted to the security database against ...
2
votes
1answer
63 views

Security Permissions - Individual inheritance rules set for this account

In my Sitecore instance some red text has appeared next to the Inheritance section in the Assign Security Rights dialog box (see screenshot below). "The item has individual inheritance rules set for ...
3
votes
1answer
149 views

500 Error Page for HTTPS connection in Sitecore JSS in Connected Mode

I'm trying to implement user authentication login and currently trying out to configure JSS connected mode to work with https (secure connection). Following https://jss.sitecore.com/docs/techniques/...
0
votes
2answers
623 views

Sitecore redirects to no-access page instead of login page

I have the following site configuration for my Sitecore 9.1 site: <site name="the-website" patch:after="site[@name='modules_website']" language="en" ... ...
0
votes
1answer
106 views

Access denied page in Sitecore when using requireLogin

Our current site (Sitecore 9.1) configuration looks like this: (simplified for readability) <site name="the-website" patch:after="site[@name='modules_website']" language="en" ... ...
0
votes
0answers
64 views

The CSRF cookie value did not match the CSRF parameter value [duplicate]

I got an error while clicking the item in Sitecore, but when I refreshed the page, I was able to click the item this time. Exception: Sitecore.Security.AntiCsrf.Exceptions.PotentialCsrfException ...
2
votes
2answers
1k views

Troubleshooting “Could not create SSL/TLS secure channel” error in XConnect on Sitecore 9.1

I have a freshly-created Sitecore 9.1 instance. After setting up the xDB Migration Tool, I get the following error message when running the Troubleshooter: ERROR [Data Exchange] at Sitecore.Xdb....
3
votes
1answer
70 views

Is it possible to teach the keepalive agent to overcome TLS/SSL certificate warnings?

We have an internal environment where the TLS/SSL certificate on tenants is not playing well with some requests. This is not a huge issue for clients who can add a one time trust for the certificate, ...
3
votes
0answers
83 views

Resetting admin password with Sitecore 9.1.1 and Identity Server after SHA512 change [duplicate]

I'm going through the security hardening steps on a new, local instance of Sitecore 9.1.1 with identity server. I made the SHA512 change in the Sitecore web.config, and I ran the database script to ...
0
votes
1answer
32 views

Roles: regional author to edit certain “global” items based on template

We need to create a role that would: - generally be only able to edit content in specific language (i.e fr-fr, regional author) - except items based on template A where they also should be able to ...
1
vote
1answer
64 views

Give Role permissions to add Url Redirects in System folder

I need to give a content author permissions to add url redirects to the folder /sitecore/system/Modules/Redirect Module, but I don't want to make them an administrator. How do I do that? I've tried ...
1
vote
1answer
341 views

JWT tokens for authentication for 9.0 UPDATE 1

I have an instance running SxC 9.0 update 1. I was working on an API which had to be consumed by a 3rd party application. Can you provide some input for using token bear mechanism to protect my API. ...
1
vote
0answers
78 views

Security Error Rebuilding Indexes

Sitecore 8.1 rev. 160302. Looking into my logfiles, there are lots of errors such as: Job Started: Index_Update_IndexName=RSearch ... Exception: System.NullReferenceException Message: Object ...
0
votes
0answers
58 views

Admin not able to restore deleted pages

I am facing issue while restoring deleted pages in sitecore. The page which is deleted by author was not able to restore by admin.Please refer below screenshot for error while restore... Thanks in ...
2
votes
1answer
32 views

Can you setup security trimming with code first JSS?

We want to restrict some pages that are behind a login on a JSS site. We use code-first development. Is is possible to setup the security in the /data/*.yml files? Or should we update the security ...
1
vote
1answer
94 views

How to check access right in SitecoreController for Sitecore 9.1

In my JSON controller I want to check the access right from the User. My code looks like this public class MyController : SitecoreController { public static bool CheckAccessRight() { ...
1
vote
1answer
45 views

Setup security for the Sitecore SXA site multiple times

When we try to add the Security Setting to the site for the first time we are able to run the Setup Security script with the link under Scripts. When we tried to make changes again in the security, ...
6
votes
0answers
182 views

How to enable custom hashing algorithm on identity server?

I have sitecore 9.1 and I added pipeline which add new hashing algorithm (pbkdf2 implementation from Zetetic team with 5000 iterations) to CryptoConfig and changed hashAlgorithmType to pbkdf2 in ...
1
vote
2answers
174 views

Security Hardening in PaaS

We are using Sitecore 9.0.2 deployed in PaaS as a general recommendation from Sitecore Security Hardening Guide perspective we are supposed to do the below items: 1)Prevent Anonymous Users access to ...
1
vote
1answer
41 views

Work Flow Security Permissions

I have a template and apply Publishing workflow on this template, I created items from this template in 2 different sites, I created 2 different users for each site,I want when the item in "site 1" ...
4
votes
1answer
264 views

IsAdministrator check no longer working on Sitecore 9.1

I created a few pages within our Sitecore setup to be accessed only by the Sitecore administrator while our site was still running on 8.2, using Sitecore.Context.IsAdministrator to check if the user ...
1
vote
1answer
225 views

Secure Azure SQL database connection using a managed identity

We are currently hosting our Sitecore 9.1 initial release on premises, but want to move the complete solution into Azure. We want to use public services and not put our solution in an ASE. To secure ...
3
votes
1answer
105 views

Sitecore 9.1 password complexity

It seems that Sitecore 9.1, with the new Identity Server, no longer uses the same way of configuring password complexity as the previous versions. Some of the links that I found related to 9.0 and ...
1
vote
1answer
92 views

Remove certain items from control panel for some users

I have users that I would like only to see the My Settings section in the Control Panel and hide the Administration, Database, Reports, Localization, and Security items. I've been looking in the Core ...
2
votes
1answer
133 views

How to fetch users in particular domain programmatically in Sitecore9

We recently upgraded our project to Sitecore9 initial release from 7.2. We were re-compiling our code including latest Sitecore.Kernel. We got this error: error CS0117: 'Factory' does not contain a ...
1
vote
1answer
45 views

Give access to Archive button in Launchpad

I'm trying to add a button to the Archive tool in the launchpad. I think I've granted access to the role the user is in - to \applications\archives and everything under it, but I think I'm missing ...
0
votes
0answers
191 views

Not seeing insert options for user

I'm trying to set up a new set of users with roles. I have them members of a couple of different roles that inherit from sitecore roles, including Author, Designer, Sitecore Client Designer and ...
0
votes
1answer
44 views

Not able to change Referrer Policy in Sitecore SXA Site

We have been trying to change Referrer Policy to 'no-referrer' but no luck. Below are the following approaches we followed for quick verification: Adding the following tag in head section of ...
4
votes
2answers
265 views

Sitecore CD instance - Restrict access to Sitecore folder without blocking keepalive.aspx?

I have a CD/CM site which I hardened by restricting access to Sitecore by adding "sitecore" to the Hidden Segments in the Request Filtering section in IIS (second answer here). However, this has ...
6
votes
2answers
300 views

You do not have permission to create an item here (Local Datasources)

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by ...
2
votes
1answer
147 views

Securing Sitecore 9.0.2 PAAS xDB & xConnect Server Role Services

We are using Sitecore 9.0.2 PAAS on Azure and we found that below server roles are not on https instead they are on http xDB Role Services Processing (prc) Reporting (rep) xConnect Server Role ...
22
votes
1answer
337 views

Can I encrypt the Sitecore Publishing Service connection strings?

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support ...