Questions tagged [security]
Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.
269
questions
0
votes
1
answer
26
views
System.ArgumentException Sitecore.Web.XFrameOptionsHeaderModule in IsSitecoreFolderRequest
In my error logs, I often see the error:
System.ArgumentException Sitecore.Web.XFrameOptionsHeaderModule in IsSitecoreFolderRequest
The request paths seem to always contain OpenAccessDataProvider. For ...
- 1,590
2
votes
1
answer
46
views
Inactive language version visits on Sitecore 9.3 website and potential security implications
Recently, we received a website visit report indicating a significant number of non-existent language versions visits on our Sitecore 9.3 website (see to the image below).
We have only enabled the ...
- 115
2
votes
1
answer
96
views
How can I secure the Experience Edge content delivery token on my Next.js/JSS app?
I am using Sitecore Experience Edge and Next.js with JSS. My site requires a section that is secured behind a login, which I know should be handled by the head application and that we should not ...
- 20k
1
vote
1
answer
29
views
Which permissions / roles are required for item cloning?
I have a user who needs the ability to clone items. The problem is that the clone options do not appear in the ribbon.
Expected State
Actual State
Which role do I need to assign the user to grant ...
- 1,590
0
votes
0
answers
41
views
PublishQueueStats.aspx 500 error: Exception of type 'System.Web.HttpUnhandledException' was thrown. Value cannot be null. Parameter name: item
In my 10.2 headless Managed Cloud solution, when I try to view the /sitecore/admin/PublishQueueStats.aspx page, I get a 500 error:
Exception: System.Web.HttpUnhandledException
Message: Exception of ...
- 1,590
1
vote
1
answer
114
views
Cumulative hotfix for Sitecore XP 10.3 [closed]
I am trying to install 'Cumulative hotfix for Sitecore XP 10.3' source at here.
I am using Sitecore 10.3.0 (XP0/XP1) currently. which is correct solution for the 10.3.0 site as one of the following ...
3
votes
1
answer
204
views
Sitecore patch from Security Bulletin SC2023-002-576660
I am trying to install Security Bulletin SC2023-002-576660 hotfix over the XP 9.3 and 10.3 instances. We have multiple Sitecore core server roles (CM, CD, Processing, Reporting, EXM Dispatch).
Do we ...
0
votes
1
answer
34
views
Hide items from admins
Is there any way to hide items in the content tree from admins? Only specific users would be visible. I already tried with the security editor etc..
- 23
1
vote
1
answer
30
views
Restricting the "More Languages" button from showing for limited users in Sitecore
I tried to restrict the display of the 'More Languages' button for limited users in Sitecore by modifying the read/write language role in /sitecore/system/Languages, but it wasn't sufficient.
Is there ...
- 23
0
votes
4
answers
333
views
Modifying session timeout for content authors not working
We are working on Sitecore 10.2 Instance, where we want the Content Author to be logged out after 5 minutes of inactivity.
For that, we have made the changes in the below files, but it didn’t work:
...
- 109
0
votes
0
answers
41
views
What are the Sitecore Next.jss security recommendations for PUT and DELETE HTTP Methods Accepted?
We recently received recommendation that one of the Next.jss sites can be accessed via the URL https://yoursiteurl/sitecore.
As part of the Sitecore Next.jss setup, we keep the Sitecore folder at root ...
- 421
3
votes
1
answer
215
views
Sitecore serialization package installation removes custom roles
There is a Sitecore 10.2 instance with serializations delivered via Sitecore.CLI v4. Item changes delivered via package and installed using the following command:
dotnet sitecore ser pkg install -f &...
- 2,178
1
vote
2
answers
86
views
Scanning files under media for vulnerability
We would like to scan our solution for security vulnerabilities. We already have a tool for static analysis.
The problem is as follows:
We are using the Sitecore media library to host the jQuery files ...
- 1,310
0
votes
1
answer
29
views
Workflow missing from explanation panel of access viewer
Does anyone know what triggers the workflow section to appear in the explanation panel of access viewer. I have the same user account configured with the same permissions on both UAT and Production. ...
7
votes
2
answers
562
views
How should security be handled for XM Cloud/Headless with Experience Edge?
In the Sitecore documentation for Experience Edge (used by XM Cloud), it states:
Experience Edge for XM does not enforce security constraints on Sitecore content. You must apply publishing ...
- 20k
0
votes
1
answer
127
views
Sitecore CD Server Trying to Access /sitecore folder
Not sure why Sitecore CD server trying to access /sitecore folder (attached screenshot). Enabled SwitchMasterToWeb.config file and disabled anonymous IIS access to the /sitecore/shell folder and did ...
- 77
1
vote
0
answers
31
views
Potentially dangerous Request.Path & illegal characters in path [duplicate]
I am trying to fix this "Potentially dangerous Request.Path" issue when URL contains characters like these - &, <, >, !
Basically, I need to redirect the page to 404.
Ex:
https://&...
- 53
0
votes
1
answer
61
views
Restricting SXA Script option for non admin Sitecore user
Is there any option to restrict non-admin Sitecore users from using the scripts option, that appears on right-clicking of tenant or site node
(Using sitecore 9.3)? Refer to the below image.
The ...
- 75
0
votes
2
answers
180
views
Assign Sitecore roles to users in custom domain
I have created a role under the Sitecore domain, with the following Sitecore roles inheriting:
Sitecore client authoring
Sitecore Client Advanced Publishing
Sitecore Client Developing
Sitecore Client ...
- 75
0
votes
1
answer
276
views
Presentation-> Details is disabled on custom role
My custom role contains following roles - Sitecore\Designer & Sitecore\Author
Also I tried giving Read/Write access to below items in core database
/sitecore/content/Applications/Content Editor/...
2
votes
1
answer
59
views
Sitecore Role access to Multiple site nodes in Sitecore
I have sitecore setup with 30 + site nodes ( site-Australia, site-Germany, site-Japan ,site-US etc.) in Sitecore. At present all editors and publishers have access to all of these nodes which in ...
- 187
3
votes
2
answers
129
views
Sitecore workbox Timeout only for single user
There is user who uses AD to access Sitecore. Whenever he tries access the workbox he ends up getting timeout error. He can access all other tabs in Sitecore without issue.
Another user with exact ...
- 367
1
vote
2
answers
513
views
Sitecore CM login is not working on Gateway url
I have requirement of exposing Sitecore CMS site through gateway url. Gateway is setup properly and gateway url has been updated in TargetHostName and identityServerAuthority in sitecore config.
But ...
- 75
0
votes
1
answer
100
views
Sitecore permission to Move item for role which Doesn't have delete permissions [duplicate]
There is a requirement that the client wants the basic Author role to have the rights to move the items in the content tree. But, that role is denied the rights to delete. From what I understand, ...
- 367
0
votes
2
answers
191
views
Need to authorize email sending with API instead of SMTP
Security policy is requiring us to update passwords regularly, and this includes service accounts previously in use for services such as SMTP from our web servers. We are looking to use the Gmail API (...
- 11
1
vote
1
answer
87
views
What Security Policies are necessary to enable the Annotate function?
I am unable to get the Annotate function working for a non-SuperUser.
My test user sees this (note missing Annotation option):
And has a group with these policies:
Things I've tried:
Enabling all ...
- 1,971
0
votes
1
answer
261
views
Input Validation on Sitecore Form Fields to prevent SQL Injection
We are using Sitecore 9.3 and the site is live.
We have forms on our site which have radio button and text fields.
The forms were created using Sitecore Forms.
We got few malicious submissions on our ...
- 619
0
votes
2
answers
237
views
How to configure default roles when using Identity Server integrated with ADFS or Azure?
We are looking for a process in which some very basic role is granted to users that allow them to purely login to Sitecore, followed by a more traditional process of manually granting access to the ...
- 17.9k
0
votes
2
answers
62
views
Need to have a Role based security access to Device Editor section at Presentation page
I need to configure Role-based access for the Placeholder settings section, how to achieve this?
Any suggestion would be helpful.
- 75
1
vote
1
answer
91
views
Sitecore Role creation API
Is there a Sitecore Role creation API similar to item creation ? Can I map user to roles using Sitecore REST API?
0
votes
1
answer
80
views
Sitecore 8.1 - few media files getting downloaded
We are working on Sitecore 8.1 instance where we have got a security issue. As per the issue, few media files are getting downloaded directly when we hit the url. Example -
https://hostname/-/media/...
- 619
2
votes
1
answer
604
views
Virtual User causing error with AntiForgeryToken, The provided anti-forgery token was meant for user "extranet\user", but the current user is ""
My site uses SSO for login so most site users do not have Sitecore accounts, as such when a user logs in a virtual user is created:
protected void CreateVirtualUser(SSOCentralUser user)
{
...
- 1,302
2
votes
0
answers
95
views
Glass v5 caching and Sitecore security
As part of a Sitecore upgrade I'm also upgrading Glass Mapper to latest version (5.8.177). We were previously on version 4. Our site uses Sitecore OOTB Security and some users do not have read access ...
- 1,214
1
vote
1
answer
236
views
Solr suspicious behavior
I've Sitecore instance hosted on Azure according to below breakdown :
Sitecore 9.1 (each component as standalone App Service)
Solr 7.2.1 (standalone App Service)
App insights configured and connected ...
- 53
0
votes
1
answer
343
views
How to resolve SQL Injection flaw in sitecore.logging.dll
We ran a Veracode scan on our Sitecore solution and it has identified that the sitecore.logging.dll has SQL injection vulnerabilities.
A full description here:
SQL injection vulnerabilities occur when ...
- 43
2
votes
1
answer
173
views
How to configure Telerik controls in a secure way for Sitecore?
I'm tuning my Sitecore setup: review configs and settings, analyse use of external services and assess security gaps. And found that Telerik controls are enabled on CD instances but not sure how they ...
- 1,843
0
votes
1
answer
76
views
AD users cannot publish anymore
We have users that login through AD and some users that don't (just plain Sitecore users).
After a deploy the AD users seems unable to publish. They can use the publish feature but the results is ...
- 20k
0
votes
0
answers
197
views
Rich Text Editor removes HTML formatting
I have a role that is a member of Sitecore/Designer, Sitecore/Author, and Sitecore Client Publishing.
When I unlock a page it creates a new version and all the Html formatting is deleted on the Rich ...
- 836
0
votes
1
answer
146
views
Assign Security Roles - changes not saved
Using Sitecore 9.3
When I assign security roles - either by going to an item in the content tree, or by going to the role manager, selecting item, and clicking on assign, I can make changes, but those ...
- 2,629
2
votes
2
answers
169
views
Disable Custom Chunk Button calling PSE script if there is no write access to selected item
I have a custom Button in the content Editor (Share), basically it just runs a PSE Script that moves final layout to shared layout.
Only a specific role can see the button.
Now my problem is, that the ...
- 257
0
votes
1
answer
116
views
Why do Sitecore security recommendations advise removing/renaming admin aspx pages [closed]
As part of Sitecore's Security guide "Securing Experience Platform" there is a suggestion to disable administrative tools (the aspx pages under /Sitecore/admin). Documented here https://doc....
- 6,040
0
votes
0
answers
283
views
How to disable content editing to users other than content owners and super admin in Sitecore workflow
We need to disable 'lock and edit' option for authors other than content owner who initiated the workflow. I able to achieve this by changing the below settings in Sitecore.config
...
- 177
1
vote
1
answer
117
views
Admin access mandatory for Sitecore Forms?
Is it mandatory for users to have admin access to be able to use the Sitecore Form Module?
I have a user with Sitecore Client Authoring role and Analytics Maintaining role, but the user is not able to ...
- 497
1
vote
1
answer
142
views
Sitecore allow item to access only by Owner
I have a requirement from one of our clients related to Sitecore security roles.
The requirement is that an item can be visible only to the owner of that item and only they have the access to edit the ...
2
votes
1
answer
72
views
How to secure critical information in Sitecore applications
We've a requirement to secure certain passwords and userIDs. These can't be in config files.
Wanted to know if Sitecore has any tools or any best practices defined for such data storage?
Any keystore ...
- 21
1
vote
1
answer
1k
views
IDX10500 error when calling Sitecore with JWT token from Postman after updating identity server certificate
I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the ...
- 11
1
vote
2
answers
383
views
I packaged a bunch of roles but when seen in next environment, the security access and options did not translate in the next environment
I spent a good deal of time creating a series of roles to highly limit access to content items depending on the role. I did not want to go through the same exercise again when I moved from the DEV ...
0
votes
1
answer
88
views
How to restrict the Security access for Sitecore Contextual ribbons
Have created a contextual ribbon and added the same to the standard values of my desired Template. The functionality is working good. But I wish to restrict the access of this Ribbon to only few ...
- 61
1
vote
0
answers
42
views
After deleting user, cannot immediately reuse username
This is Sitecore 9.1.1, and we're working with doing some test runs on user creation. Basically folks are creating users to log into the front end of the site, but they're sometimes not picking the ...
- 5,092
1
vote
1
answer
193
views
Editors cannot edit certain aspects of presentation details, such as a component's datasource or placeholder
I am working on an issue facing some Sitecore editors.
These editors can edit items normally once it is locked to them but cannot edit certain aspects of presentation details of those items. If the ...