Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
1 vote
1 answer
46 views

Difference between aspnet_Users, aspnet_Profile and aspnet_Membership tables in Sitecore

Can someone please help me understand the use and difference between aspnet_Users, aspnet_Profile and aspnet_Membership tables in Sitecore? And what sequence Sitecore follows to create user I mean ...
Rashmi Ranjan's user avatar
0 votes
1 answer
28 views

System.ArgumentException Sitecore.Web.XFrameOptionsHeaderModule in IsSitecoreFolderRequest

In my error logs, I often see the error: System.ArgumentException Sitecore.Web.XFrameOptionsHeaderModule in IsSitecoreFolderRequest The request paths seem to always contain OpenAccessDataProvider. For ...
Marcel Gruber's user avatar
2 votes
1 answer
48 views

Inactive language version visits on Sitecore 9.3 website and potential security implications

Recently, we received a website visit report indicating a significant number of non-existent language versions visits on our Sitecore 9.3 website (see to the image below). We have only enabled the ...
Alexander's user avatar
  • 117
2 votes
1 answer
119 views

How can I secure the Experience Edge content delivery token on my Next.js/JSS app?

I am using Sitecore Experience Edge and Next.js with JSS. My site requires a section that is secured behind a login, which I know should be handled by the head application and that we should not ...
Richard Seal's user avatar
  • 20.4k
1 vote
1 answer
31 views

Which permissions / roles are required for item cloning?

I have a user who needs the ability to clone items. The problem is that the clone options do not appear in the ribbon. Expected State Actual State Which role do I need to assign the user to grant ...
Marcel Gruber's user avatar
0 votes
0 answers
44 views

PublishQueueStats.aspx 500 error: Exception of type 'System.Web.HttpUnhandledException' was thrown. Value cannot be null. Parameter name: item

In my 10.2 headless Managed Cloud solution, when I try to view the /sitecore/admin/PublishQueueStats.aspx page, I get a 500 error: Exception: System.Web.HttpUnhandledException Message: Exception of ...
Marcel Gruber's user avatar
1 vote
1 answer
145 views

Cumulative hotfix for Sitecore XP 10.3 [closed]

I am trying to install 'Cumulative hotfix for Sitecore XP 10.3' source at here. I am using Sitecore 10.3.0 (XP0/XP1) currently. which is correct solution for the 10.3.0 site as one of the following ...
Dharmnath Dubal's user avatar
3 votes
1 answer
285 views

Sitecore patch from Security Bulletin SC2023-002-576660

I am trying to install Security Bulletin SC2023-002-576660 hotfix over the XP 9.3 and 10.3 instances. We have multiple Sitecore core server roles (CM, CD, Processing, Reporting, EXM Dispatch). Do we ...
Dharmnath Dubal's user avatar
0 votes
1 answer
39 views

Hide items from admins

Is there any way to hide items in the content tree from admins? Only specific users would be visible. I already tried with the security editor etc..
krisztian's user avatar
2 votes
1 answer
32 views

Restricting the "More Languages" button from showing for limited users in Sitecore

I tried to restrict the display of the 'More Languages' button for limited users in Sitecore by modifying the read/write language role in /sitecore/system/Languages, but it wasn't sufficient. Is there ...
sahar Nofal's user avatar
0 votes
4 answers
413 views

Modifying session timeout for content authors not working

We are working on Sitecore 10.2 Instance, where we want the Content Author to be logged out after 5 minutes of inactivity. For that, we have made the changes in the below files, but it didn’t work: ...
Avinash Sharma's user avatar
0 votes
0 answers
42 views

What are the Sitecore Next.jss security recommendations for PUT and DELETE HTTP Methods Accepted?

We recently received recommendation that one of the Next.jss sites can be accessed via the URL https://yoursiteurl/sitecore. As part of the Sitecore Next.jss setup, we keep the Sitecore folder at root ...
Jitendra soni's user avatar
3 votes
1 answer
255 views

Sitecore serialization package installation removes custom roles

There is a Sitecore 10.2 instance with serializations delivered via Sitecore.CLI v4. Item changes delivered via package and installed using the following command: dotnet sitecore ser pkg install -f &...
Serhii Shushliapin's user avatar
1 vote
2 answers
96 views

Scanning files under media for vulnerability

We would like to scan our solution for security vulnerabilities. We already have a tool for static analysis. The problem is as follows: We are using the Sitecore media library to host the jQuery files ...
NutsAndBolts's user avatar
  • 1,330
0 votes
1 answer
30 views

Workflow missing from explanation panel of access viewer

Does anyone know what triggers the workflow section to appear in the explanation panel of access viewer. I have the same user account configured with the same permissions on both UAT and Production. ...
Madgibbon's user avatar
7 votes
2 answers
636 views

How should security be handled for XM Cloud/Headless with Experience Edge?

In the Sitecore documentation for Experience Edge (used by XM Cloud), it states: Experience Edge for XM does not enforce security constraints on Sitecore content. You must apply publishing ...
Richard Seal's user avatar
  • 20.4k
0 votes
1 answer
150 views

Sitecore CD Server Trying to Access /sitecore folder

Not sure why Sitecore CD server trying to access /sitecore folder (attached screenshot). Enabled SwitchMasterToWeb.config file and disabled anonymous IIS access to the /sitecore/shell folder and did ...
Sun's user avatar
  • 89
1 vote
0 answers
35 views

Potentially dangerous Request.Path & illegal characters in path [duplicate]

I am trying to fix this "Potentially dangerous Request.Path" issue when URL contains characters like these - &, <, >, ! Basically, I need to redirect the page to 404. Ex: https://&...
Sharath's user avatar
  • 53
0 votes
1 answer
65 views

Restricting SXA Script option for non admin Sitecore user

Is there any option to restrict non-admin Sitecore users from using the scripts option, that appears on right-clicking of tenant or site node (Using sitecore 9.3)? Refer to the below image. The ...
Tabbuu's user avatar
  • 75
0 votes
2 answers
231 views

Assign Sitecore roles to users in custom domain

I have created a role under the Sitecore domain, with the following Sitecore roles inheriting: Sitecore client authoring Sitecore Client Advanced Publishing Sitecore Client Developing Sitecore Client ...
Tabbuu's user avatar
  • 75
0 votes
1 answer
358 views

Presentation-> Details is disabled on custom role

My custom role contains following roles - Sitecore\Designer & Sitecore\Author Also I tried giving Read/Write access to below items in core database /sitecore/content/Applications/Content Editor/...
Pavan Toshniwal's user avatar
2 votes
1 answer
64 views

Sitecore Role access to Multiple site nodes in Sitecore

I have sitecore setup with 30 + site nodes ( site-Australia, site-Germany, site-Japan ,site-US etc.) in Sitecore. At present all editors and publishers have access to all of these nodes which in ...
Kapil Naker's user avatar
3 votes
2 answers
137 views

Sitecore workbox Timeout only for single user

There is user who uses AD to access Sitecore. Whenever he tries access the workbox he ends up getting timeout error. He can access all other tabs in Sitecore without issue. Another user with exact ...
Meghan's user avatar
  • 427
1 vote
2 answers
571 views

Sitecore CM login is not working on Gateway url

I have requirement of exposing Sitecore CMS site through gateway url. Gateway is setup properly and gateway url has been updated in TargetHostName and identityServerAuthority in sitecore config. But ...
Bharath's user avatar
  • 85
0 votes
1 answer
108 views

Sitecore permission to Move item for role which Doesn't have delete permissions [duplicate]

There is a requirement that the client wants the basic Author role to have the rights to move the items in the content tree. But, that role is denied the rights to delete. From what I understand, ...
Meghan's user avatar
  • 427
0 votes
2 answers
213 views

Need to authorize email sending with API instead of SMTP

Security policy is requiring us to update passwords regularly, and this includes service accounts previously in use for services such as SMTP from our web servers. We are looking to use the Gmail API (...
sturtus's user avatar
  • 11
1 vote
1 answer
87 views

What Security Policies are necessary to enable the Annotate function?

I am unable to get the Annotate function working for a non-SuperUser. My test user sees this (note missing Annotation option): And has a group with these policies: Things I've tried: Enabling all ...
Dan Solovay's user avatar
  • 2,001
0 votes
1 answer
308 views

Input Validation on Sitecore Form Fields to prevent SQL Injection

We are using Sitecore 9.3 and the site is live. We have forms on our site which have radio button and text fields. The forms were created using Sitecore Forms. We got few malicious submissions on our ...
NewbieHere's user avatar
0 votes
2 answers
261 views

How to configure default roles when using Identity Server integrated with ADFS or Azure?

We are looking for a process in which some very basic role is granted to users that allow them to purely login to Sitecore, followed by a more traditional process of manually granting access to the ...
Michael West's user avatar
  • 18.1k
0 votes
2 answers
62 views

Need to have a Role based security access to Device Editor section at Presentation page

I need to configure Role-based access for the Placeholder settings section, how to achieve this? Any suggestion would be helpful.
Bharath's user avatar
  • 85
1 vote
1 answer
100 views

Sitecore Role creation API

Is there a Sitecore Role creation API similar to item creation ? Can I map user to roles using Sitecore REST API?
sumangala nair's user avatar
0 votes
1 answer
83 views

Sitecore 8.1 - few media files getting downloaded

We are working on Sitecore 8.1 instance where we have got a security issue. As per the issue, few media files are getting downloaded directly when we hit the url. Example - https://hostname/-/media/...
NewbieHere's user avatar
2 votes
1 answer
635 views

Virtual User causing error with AntiForgeryToken, The provided anti-forgery token was meant for user "extranet\user", but the current user is ""

My site uses SSO for login so most site users do not have Sitecore accounts, as such when a user logs in a virtual user is created: protected void CreateVirtualUser(SSOCentralUser user) { ...
Erica Stockwell-Alpert's user avatar
2 votes
0 answers
100 views

Glass v5 caching and Sitecore security

As part of a Sitecore upgrade I'm also upgrading Glass Mapper to latest version (5.8.177). We were previously on version 4. Our site uses Sitecore OOTB Security and some users do not have read access ...
Jeroen's user avatar
  • 1,214
1 vote
1 answer
271 views

Solr suspicious behavior

I've Sitecore instance hosted on Azure according to below breakdown : Sitecore 9.1 (each component as standalone App Service) Solr 7.2.1 (standalone App Service) App insights configured and connected ...
mamhh's user avatar
  • 53
0 votes
1 answer
354 views

How to resolve SQL Injection flaw in sitecore.logging.dll

We ran a Veracode scan on our Sitecore solution and it has identified that the sitecore.logging.dll has SQL injection vulnerabilities. A full description here: SQL injection vulnerabilities occur when ...
James's user avatar
  • 43
2 votes
1 answer
195 views

How to configure Telerik controls in a secure way for Sitecore?

I'm tuning my Sitecore setup: review configs and settings, analyse use of external services and assess security gaps. And found that Telerik controls are enabled on CD instances but not sure how they ...
Anna Gevel's user avatar
  • 1,918
0 votes
1 answer
77 views

AD users cannot publish anymore

We have users that login through AD and some users that don't (just plain Sitecore users). After a deploy the AD users seems unable to publish. They can use the publish feature but the results is ...
Gatogordo's user avatar
  • 20k
0 votes
0 answers
206 views

Rich Text Editor removes HTML formatting

I have a role that is a member of Sitecore/Designer, Sitecore/Author, and Sitecore Client Publishing. When I unlock a page it creates a new version and all the Html formatting is deleted on the Rich ...
Ercan Polat's user avatar
0 votes
1 answer
170 views

Assign Security Roles - changes not saved

Using Sitecore 9.3 When I assign security roles - either by going to an item in the content tree, or by going to the role manager, selecting item, and clicking on assign, I can make changes, but those ...
Ethan Schofer's user avatar
2 votes
2 answers
180 views

Disable Custom Chunk Button calling PSE script if there is no write access to selected item

I have a custom Button in the content Editor (Share), basically it just runs a PSE Script that moves final layout to shared layout. Only a specific role can see the button. Now my problem is, that the ...
Bgl86's user avatar
  • 267
0 votes
1 answer
118 views

Why do Sitecore security recommendations advise removing/renaming admin aspx pages [closed]

As part of Sitecore's Security guide "Securing Experience Platform" there is a suggestion to disable administrative tools (the aspx pages under /Sitecore/admin). Documented here https://doc....
Matthew Dresser's user avatar
0 votes
0 answers
304 views

How to disable content editing to users other than content owners and super admin in Sitecore workflow

We need to disable 'lock and edit' option for authors other than content owner who initiated the workflow. I able to achieve this by changing the below settings in Sitecore.config ...
Thamizh's user avatar
  • 187
1 vote
1 answer
124 views

Admin access mandatory for Sitecore Forms?

Is it mandatory for users to have admin access to be able to use the Sitecore Form Module? I have a user with Sitecore Client Authoring role and Analytics Maintaining role, but the user is not able to ...
Debaparna's user avatar
  • 497
1 vote
1 answer
146 views

Sitecore allow item to access only by Owner

I have a requirement from one of our clients related to Sitecore security roles. The requirement is that an item can be visible only to the owner of that item and only they have the access to edit the ...
Gowthamaraja Eswaramoorthy's user avatar
2 votes
1 answer
78 views

How to secure critical information in Sitecore applications

We've a requirement to secure certain passwords and userIDs. These can't be in config files. Wanted to know if Sitecore has any tools or any best practices defined for such data storage? Any keystore ...
Rishi's user avatar
  • 21
1 vote
1 answer
1k views

IDX10500 error when calling Sitecore with JWT token from Postman after updating identity server certificate

I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the ...
csb's user avatar
  • 11
1 vote
2 answers
407 views

I packaged a bunch of roles but when seen in next environment, the security access and options did not translate in the next environment

I spent a good deal of time creating a series of roles to highly limit access to content items depending on the role. I did not want to go through the same exercise again when I moved from the DEV ...
Carlos Rodriguez's user avatar
0 votes
1 answer
90 views

How to restrict the Security access for Sitecore Contextual ribbons

Have created a contextual ribbon and added the same to the standard values of my desired Template. The functionality is working good. But I wish to restrict the access of this Ribbon to only few ...
iMathi's user avatar
  • 61
1 vote
0 answers
42 views

After deleting user, cannot immediately reuse username

This is Sitecore 9.1.1, and we're working with doing some test runs on user creation. Basically folks are creating users to log into the front end of the site, but they're sometimes not picking the ...
Ken McAndrew's user avatar
  • 5,092

1
2 3 4 5 6