Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

1
vote
1answer
20 views

Give access to Archive button in Launchpad

I'm trying to add a button to the Archive tool in the launchpad. I think I've granted access to the role the user is in - to \applications\archives and everything under it, but I think I'm missing ...
0
votes
0answers
42 views

Not seeing insert options for user

I'm trying to set up a new set of users with roles. I have them members of a couple of different roles that inherit from sitecore roles, including Author, Designer, Sitecore Client Designer and ...
0
votes
1answer
22 views

Not able to change Referrer Policy in Sitecore SXA Site

We have been trying to change Referrer Policy to 'no-referrer' but no luck. Below are the following approaches we followed for quick verification: Adding the following tag in head section of ...
4
votes
2answers
77 views

Sitecore CD instance - Restrict access to Sitecore folder without blocking keepalive.aspx?

I have a CD/CM site which I hardened by restricting access to Sitecore by adding "sitecore" to the Hidden Segments in the Request Filtering section in IIS (second answer here). However, this has ...
6
votes
2answers
97 views

You do not have permission to create an item here (Local Datasources)

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by ...
2
votes
1answer
49 views

Securing Sitecore 9.0.2 PAAS xDB & xConnect Server Role Services

We are using Sitecore 9.0.2 PAAS on Azure and we found that below server roles are not on https instead they are on http xDB Role Services Processing (prc) Reporting (rep) xConnect Server Role ...
21
votes
1answer
245 views

Can I encrypt the Sitecore Publishing Service connection strings?

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support ...
0
votes
1answer
45 views

Unable to fetch item using getitem method

I was trying to access item using getitem method from SOAP service. Sitecore.Data.Items.Item item = Sitecore.context.Database.GetItem(<ID>) But Item is null. I tried to fetch using Id and path ...
1
vote
2answers
218 views

Where are the access rights stored for security roles in serialized files?

When we create security roles and assign access rights, corresponding serialized files for role get created. But when we look at the files we don't see any data related to access rights. So just ...
0
votes
1answer
30 views

Determine access rights of a user in a particular role

I want to fetch access rights of a user to an item who has been under a security role. I am controlling the access to that particular item by adding the user to that role. Can someone help how I can ...
2
votes
3answers
76 views

How to Transfer Users with active password policy

I want to transfer users from our QA environment to the PROD environment on Sitecore.NET 8.2 (rev. 170728). It is totally fine if the users are deactivated and have a random password set. ...
1
vote
1answer
90 views

Inheriting Sitecore Roles

I have a role "Editor" which is having certain permissions and don't have read access to Sitecore/Social item. Now i need to create a new role "Approver" which is having same access as Editor but ...
1
vote
1answer
33 views

Sitecore roles required for content testing

I'm using Sitecore 8.2 Update 7 and I'm trying to restrict access to my Sitecore Content Editors. One of them wants to run a content test using the built-in testing controls. When I go to "Create a ...
4
votes
3answers
83 views

How to identify which users have access to particular item?

I want to know the users who all have access Read/Write to particular item. How to fetch that info? is there any SQL table to extract?
0
votes
0answers
42 views

Combination of multiple roles

We have a multi-app multi-site app structure like follows: Commerce BE Pages Feature 1 Feature 2 DE Pages Feature 1 Feature 2 NL Pages Feature 1 Feature 2 ...
0
votes
1answer
44 views

Page Creation role in Sitecore Habitat

In the Sitecore Habitat implementation, I am looking for a role that is allowed to create/rename and delete items. I see the role habitat\Project Habitat Content Author, that is only allowed to read ...
1
vote
0answers
38 views

List of recommended patches for specific Sitecore version

Is there an easy way to find a list of recommended patches for a specific Sitecore version/update? I can see that individual patches are recommended for a particular version but I can't find a a list ...
1
vote
1answer
58 views

Disabling the Autocomplete in WFFM

Is there a possibility to disable the autocomplete of Sitecore WFFM text box. We are using Sitecore 8.1
1
vote
1answer
40 views

The form was not loaded due to an error. 401 403 unauthorized

Using custom roles setup to lockdown access. Gave access rights to the Forms folder and the app menu for the launchpad. However I receive the error on the GUI after clicking one of the forms to open ...
1
vote
0answers
158 views

Can I use self-signed certificates for xConnect, Solr, and Sitecore Commerce in a Sitecore 9 XP0 production deployment?

I am planning a small Sitecore 9.0.2 + Sitecore Experience Commerce production deployment for a demo website with very low traffic. I do not have a lot of time to provision multiple servers, so I plan ...
0
votes
0answers
27 views

Why is SHA512 not the default memberschip hash algorithm?

By default, when you install Sitecore (9), the default encryption algorith for the membership provider is SHA1. The security guidelines state to change this to the strongen SHA512 algorithm. Is ...
8
votes
1answer
177 views

X-Frame Option in Sitecore 9

I have added the following X-frame-options header in web.config: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> <add name="X-Frame-Options" value="...
1
vote
1answer
58 views

Sitecore security hardening Paas [closed]

We have setup a Paas enviroment with Sitecore 9.0.1 XP scaled. The problem is that Sitecore login and admin tools are available on the Content Delivery server. My understanding is that Security ...
3
votes
1answer
77 views

Decreasing security rights on sitecore role

I have a role which is inheriting for other roles (one of which is sitecore\Designer). The role now has all access rights to Templates and its sub items. Now I want to reduce the access rights such ...
2
votes
1answer
76 views

Sitecore Password setting configuration

We are on 6.3.1 rev. 110112 and We have some specific requirements for setting up the password in Sitecore from the client side. For Example, we have the following requirements for the password ...
2
votes
1answer
30 views

How can I copy security fields between environments?

How can I copy security fields between environments? I can't use TDS serialization because there are too many changes that would be propagated. Is it possible to simply only copy the security fields?...
4
votes
2answers
104 views

Allow hyphens for Sitecore security roles?

We are implementing a customer's membership and roles database that is used in multiple applications. They have used hyphen in the role names, which is generally allowed but Sitecore does not allow by ...
5
votes
1answer
91 views

Multisite publishing issue in SXA

Using SXA 1.6 and Sitecore 9.0.1 , we have an environment with single tenant and multi sites ex: site1 , site2 ,.. we setup OOB security so only users in site1 can edit their content only and same for ...
3
votes
0answers
35 views

Stop users logging in to the sitecore CMS with the same account in different browsers

A client has requested that they would like to stop users being able to log into sitecore with the same account in different browsers or machines etc. Does anyone know if this is possible?
3
votes
1answer
262 views

How to remove admin role permissions programatically?

I tried changing it via protected void RemoveRoles(User user) { using (new SecurityDisabler()) { UserRoles.FromUser(user).RemoveAll(); UserProfile profile =...
3
votes
1answer
56 views

How to catch whether the item's __Security field is a modified publish

I want to share authority to read content with another system. When contents are published to the public site, we create processing to output the data to the database. Is there a way to catch only if ...
1
vote
2answers
158 views

Sitecore content delivery server security hardening anonymous access

I'm using Sitecore 8.0 update 6 and following Sitecore security hardening documentation. I'd like to redirect user when the request is made to https://www.foo.com/sitecore to https://www.foo.com/404. ...
4
votes
2answers
128 views

Granting a role access to a field

I have a component in my sitecore instance called an Article Download component. One of the fields for this component is called Download Item and it is the type link (not General Link). My authors are ...
0
votes
1answer
119 views

Forms Authentication cookie with Sitecore

Does it require to explicitly set authentication cookie after authenticating user via Sitecore Authentication Manager? if (Sitecore.Security.Authentication.AuthenticationManager.Login( ...
3
votes
1answer
70 views

Check access rights programmatically for scheduled task

I have a scheduled task in Sitecore. In the task I need run the code, that send notification to all users that have access to specific WorkFlow state. I got list of all users under sitecore domain ...
6
votes
1answer
184 views

Sitecore IFrame rendering HTTP instead of HTTPS

My application is using HTTPS. The Sitecore sites configurations scheme are all set to HTTPS. When I'm on Sitecore Management some internal sitecore iframes (Insert Link, Template Editor, Package ...
1
vote
1answer
207 views

Sitecore Azure WebApp and TLS 1.2

I want to use the most secure TLS 1.2 on Sitecore Azure Web apps for all 4 roles - CD, CM, PRC and REP. I did not do any changes in Analytics processing and reporting - so, I do not deploy my code to ...
1
vote
1answer
79 views

Getting Error while creating the Virtual User

We are using ADFS Authenticator module, when we are trying to create a virtual user, we are getting the below error: Expecting state ‘Element’.. Encountered ‘Text’ with name ”, namespace ”. ...
0
votes
1answer
41 views

Allowing Sitecore's gateway to management server to public internet?

Is it against Sitecore's best security practices to allow the gateway to Sitecore's management server to the public internet? e.g www.test.com/sitecore
1
vote
2answers
527 views

Authentication / Login for Custom ServicesApiController

I've created a custom API Controller that inherits from ServicesApiController. I've created also custom route and it all works fine. Something like the following: public class ExampleController : ...
0
votes
1answer
151 views

Security Roles required for Web Forms For Marketers email save action

I have been trying to tidy up permissions on our Sitecore install. My admin account has every permission haphazardly applied which causes all kinds of issues, but I can create WFFM forms with email ...
5
votes
1answer
98 views

Can username be updated in Sitecore?

I'm working on a Sitecore 8.1 (rev. 160302) build running our custom code on .NET 4.5. As far as I know using the out of the box Security provider there are no ways to update username programatically ...
1
vote
1answer
61 views

Dictionary and content tree permissions removed [duplicate]

We have a dictionary items which are moved from dev to UAT using Sitecore package installation. On UAT , the content authors are given explicit permissions on the Dictionary folder. These permissions ...
1
vote
1answer
87 views

Is there any limit for concurrent extranet domain users in a Sitecore website?

How many extranet users can login to a sitecore website at the same time? Is there any limitation for the number of concurrent logins? NB: This question is not about sitecore users(Number of ...
11
votes
1answer
996 views

WAF support with Sitecore Experience Platform

We are looking for a Web Application Firewall (WAF) solution for our Sitecore CMS implementation, because we are an Azure shop we specifically wanted to use the WAF feature on the Azure AppGateway ...
2
votes
1answer
117 views

Creating or editing Marketing Automation campaigns in Sitecore 9.0.1 is giving us “Authorization has been denied for this request.” in Chrome

We are using Sitecore 9.0.1 and Marketing Automation heavily on our current small project. On one of our environments, we are getting Authorization has been denied for this request. when we are ...
1
vote
0answers
122 views

HttpAntiForgeryException (0x80004005)

The Experience Editor is showing the following message: A serious error occurred please contact the administrator Sitecore logs are displaying the following information: 6732 11:46:21 ERROR Error ...
5
votes
1answer
225 views

Prevent DOM XSS in Sitecore

Does Sitecore have an inbuilt mechanism to prevent DOM XSS A user should not be able to run http://{url}/#<>Script> from the browser what is the best practice to handle such scenarios? This ...
-1
votes
0answers
77 views

Captcha Image is not rendering in Sitecore 8.2

We are upgrading the application from Sitecore 7.2 to 8.2 version. Version 7.2 has Captcha image which is rendering properly but when application is upgraded in 8.2 the Captcha is not rendering in ...
0
votes
1answer
240 views

Sitecore login page returns 403 - Forbidden: Access is denied after HTTPS is enabled

After enabling HTTPS on a Sitecore website that is hosted on the AWS cloud, we are unable to access the Sitecore login page. https://www.[domainname].com/sitecore which returns 403 - Forbidden:Access ...