Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

Upgrade the Jquery and Bootstrap Versions in Sitecore 9.3

We are using Sitecore 9.3 with SXA. In the quality scan report, it was found that jQueryand Bootstrapversions being used are vulnerable and it was suggested to upgrade the versions of both as stated ...
user avatar
0 votes
2 answers
54 views

How to configure default roles when using Identity Server integrated with ADFS or Azure?

We are looking for a process in which some very basic role is granted to users that allow them to purely login to Sitecore, followed by a more traditional process of manually granting access to the ...
user avatar
  • 16.4k
0 votes
2 answers
42 views

Need to have a Role based security access to Device Editor section at Presentation page

I need to configure Role-based access for the Placeholder settings section, how to achieve this? Any suggestion would be helpful.
user avatar
  • 25
1 vote
1 answer
26 views

Sitecore Role creation API

Is there a Sitecore Role creation API similar to item creation ? Can I map user to roles using Sitecore REST API?
user avatar
0 votes
0 answers
14 views

JSS import security is not stopping content from being overwritten

I am trying to stop the JSS deploy to my local sitecore environment from overwriting some personalisation rules on a route that I have applied on a route. I have tried following the steps outlined in ...
user avatar
0 votes
1 answer
34 views

Sitecore 8.1 - few media files getting downloaded

We are working on Sitecore 8.1 instance where we have got a security issue. As per the issue, few media files are getting downloaded directly when we hit the url. Example - https://hostname/-/media/...
user avatar
1 vote
1 answer
78 views

Virtual User causing error with AntiForgeryToken, The provided anti-forgery token was meant for user "extranet\user", but the current user is ""

My site uses SSO for login so most site users do not have Sitecore accounts, as such when a user logs in a virtual user is created: protected void CreateVirtualUser(SSOCentralUser user) { ...
user avatar
2 votes
0 answers
49 views

Glass v5 caching and Sitecore security

As part of a Sitecore upgrade I'm also upgrading Glass Mapper to latest version (5.8.177). We were previously on version 4. Our site uses Sitecore OOTB Security and some users do not have read access ...
user avatar
  • 1,069
1 vote
1 answer
97 views

Solr suspicious behavior

I've Sitecore instance hosted on Azure according to below breakdown : Sitecore 9.1 (each component as standalone App Service) Solr 7.2.1 (standalone App Service) App insights configured and connected ...
user avatar
  • 33
0 votes
1 answer
161 views

How to resolve SQL Injection flaw in sitecore.logging.dll

We ran a Veracode scan on our Sitecore solution and it has identified that the sitecore.logging.dll has SQL injection vulnerabilities. A full description here: SQL injection vulnerabilities occur when ...
user avatar
  • 33
2 votes
1 answer
51 views

How to configure Telerik controls in a secure way for Sitecore?

I'm tuning my Sitecore setup: review configs and settings, analyse use of external services and assess security gaps. And found that Telerik controls are enabled on CD instances but not sure how they ...
user avatar
0 votes
1 answer
33 views

AD users cannot publish anymore

We have users that login through AD and some users that don't (just plain Sitecore users). After a deploy the AD users seems unable to publish. They can use the publish feature but the results is ...
user avatar
  • 19.1k
0 votes
0 answers
66 views

Rich Text Editor removes HTML formatting

I have a role which is a member of "Sitecore/Designer", "Sitecore/Author" and "Sitecore Client Publishing". When I unlock a page it creates a new version and all the Html ...
user avatar
0 votes
1 answer
77 views

Assign Security Roles - changes not saved

Using Sitecore 9.3 When I assign security roles - either by going to an item in the content tree, or by going to the role manager, selecting item, and clicking on assign, I can make changes, but those ...
user avatar
2 votes
2 answers
59 views

Disable Custom Chunk Button calling PSE script if there is no write access to selected item

I have a custom Button in the content Editor (Share), basically it just runs a PSE Script that moves final layout to shared layout. Only a specific role can see the button. Now my problem is, that the ...
user avatar
  • 257
0 votes
1 answer
74 views

Why do Sitecore security recommendations advise removing/renaming admin aspx pages [closed]

As part of Sitecore's Security guide "Securing Experience Platform" there is a suggestion to disable administrative tools (the aspx pages under /Sitecore/admin). Documented here https://doc....
user avatar
0 votes
0 answers
121 views

How to disable content editing to users other than content owners and super admin in Sitecore workflow

We need to disable 'lock and edit' option for authors other than content owner who initiated the workflow. I able to achieve this by changing the below settings in Sitecore.config ...
user avatar
  • 53
1 vote
1 answer
67 views

Admin access mandatory for Sitecore Forms?

Is it mandatory for users to have admin access to be able to use the Sitecore Form Module? I have a user with Sitecore Client Authoring role and Analytics Maintaining role, but the user is not able to ...
user avatar
  • 395
1 vote
1 answer
85 views

Sitecore allow item to access only by Owner

I have a requirement from one of our clients related to Sitecore security roles. The requirement is that an item can be visible only to the owner of that item and only they have the access to edit the ...
user avatar
2 votes
1 answer
51 views

How to secure critical information in Sitecore applications

We've a requirement to secure certain passwords and userIDs. These can't be in config files. Wanted to know if Sitecore has any tools or any best practices defined for such data storage? Any keystore ...
user avatar
  • 21
1 vote
1 answer
560 views

IDX10500 error when calling Sitecore with JWT token from Postman after updating identity server certificate

I am using Sitecore 9.1 and have recently updated my .pfx identity server certificates in Azure, due to the old ones expiring. After updating the Sitecore.IdentityServer.Host.xml configuration, the ...
user avatar
  • 11
1 vote
2 answers
237 views

I packaged a bunch of roles but when seen in next environment, the security access and options did not translate in the next environment

I spent a good deal of time creating a series of roles to highly limit access to content items depending on the role. I did not want to go through the same exercise again when I moved from the DEV ...
user avatar
0 votes
1 answer
46 views

How to restrict the Security access for Sitecore Contextual ribbons

Have created a contextual ribbon and added the same to the standard values of my desired Template. The functionality is working good. But I wish to restrict the access of this Ribbon to only few ...
user avatar
  • 51
1 vote
0 answers
35 views

After deleting user, cannot immediately reuse username

This is Sitecore 9.1.1, and we're working with doing some test runs on user creation. Basically folks are creating users to log into the front end of the site, but they're sometimes not picking the ...
user avatar
  • 5,040
1 vote
1 answer
83 views

Editors cannot edit certain aspects of presentation details, such as a component's datasource or placeholder

I am working on an issue facing some Sitecore editors. These editors can edit items normally once it is locked to them but cannot edit certain aspects of presentation details of those items. If the ...
user avatar
1 vote
0 answers
48 views

Most roles from AD Connector don't show in Security Editor

I'm attempting to sort out security permissions in our 8.1u3 installation, but I've run into a curious snag: we use the Active Directory connector to pull in all of the users and security groups from ...
user avatar
1 vote
0 answers
57 views

Sitecore PowerShell access allow/deny at same time

Hello Sitecore SPE Experts, I have a very basic question, hope anyone help me: I am using something like below Add-ItemAcl -Path master:\content\home -AccessRight "item:read" -PropagationType Any - ...
user avatar
2 votes
0 answers
59 views

Setting language read access for endusers

We have followed this excellent guide: https://briancaos.wordpress.com/2010/06/30/setting-up-security-on-languages-in-sitecore-6/ for setting up security in the Sitecore client for our Sitecore ...
user avatar
  • 834
3 votes
1 answer
376 views

Getting notifications for Sitecore security patches

As we know Sitecore release security patches sometime which needs to be applied ASAP. Is there any way so that whenever any critical security patch is released by Sitecore, we will be notified? Do we ...
user avatar
0 votes
0 answers
29 views

Access to templates folder for non-admin users [duplicate]

I would like to give access to a user to a particular set of templates for editing, but I can't seem to do this. The user is not an admin, and no matter what I do I can't seem to have him see the ...
user avatar
  • 1,045
-1 votes
1 answer
141 views

CM Server Phantom.js recommendation to move dataFolder does not work - has anyone implemented this?

I would like to know if the Sitecore Content Management Server security recommendation for phantom.js actually works? Has anyone successfully implemented it? I am specifically talking about the ...
user avatar
  • 21
0 votes
1 answer
47 views

Role required to display Add an account dialog

Which of the standard Sitecore roles is required for a CMS user to view the 'Add an account' dialog via the Content Editor? Any Item > Security > Assign security Adding the user to the sitecore\...
user avatar
2 votes
2 answers
151 views

How to grant bucket sync permission to role

I have a custom bucket that organizes items using a custom rule based on the value of a date field called "Event Start Date" on each page item. I'm trying to give content authors the ability to ...
user avatar
0 votes
1 answer
311 views

Manage security access for items with GraphQL

We noticed that there is no limitation on what data can be queried, all the data in GraphQL can be retrieved within the Sitecore instance. Any GraphQL request with the correct API Key can retrieve ...
user avatar
1 vote
0 answers
55 views

What permissions does Sitecore need to manage Solr?

Solr 6.1.0 + Zookeeper + Basic Authentication Sitecore 8.0 Update-5 What are the minimum permissions required for Sitecore to manage Solr? The official documentation says nothing about this AFAICT ...
user avatar
  • 175
4 votes
2 answers
367 views

JSS layout service, how to restrict public access

I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API. Please note, I am not taking about the login/logout ...
user avatar
1 vote
1 answer
257 views

Login virtual user to Sitecore Content Editor

Sitecore 8.2 I need to login virtual user with name like 'virtualUser2000' (not 'sitecore\virtualUser2000') to sitecore content editor. My code: var virtualUser = _authenticationManager....
user avatar
  • 1,410
2 votes
1 answer
57 views

What are the consequences of an item locked in the web database?

While reviewing if an item was published in the Web database, I noticed some items showed the locked gutter icon. Is there a change in behavior with respect to viewing the published site if an item ...
user avatar
  • 16.4k
0 votes
1 answer
331 views

Writing an IIS rewrite rule for the Sitecore control panel URL

If I try to access http://mydomain.com/sitecore I get a 403 error. I would instead prefer for IIS to automatically redirect to https://mydomain.com/sitecore. I added the following rule in ...
user avatar
2 votes
2 answers
64 views

Securing the Sitecore client on a single server setup with CDN

On a single server setup for Sitecore which has a CDN in front of it how would you go about securing the Sitecore client. If there was no CDN I would implement IP security to block access to the ...
user avatar
2 votes
1 answer
364 views

Sitecore 9.2 Virtual User Authentication and SessionId Cookie [closed]

On the project I'm working on, we have chosen to use Sitecore 9.2 XM with Identity Server disabled. Where in the pipeline should I expect to see the ASP.NET_SessionId cookie get generated to be sent ...
user avatar
2 votes
1 answer
88 views

What happens when you change the security domain setting for a site?

I was going through Sitecore domains documentation and found the link interesting. https://www.linkedin.com/pulse/what-importance-security-domains-sitecore-rohit-chopra Upon going through that, I ...
user avatar
0 votes
1 answer
389 views

Allowing custom role to move items

So according to this article it was a case of jumping into the Core database and setting read and write permissions on the Move To item. https://community.sitecore.net/developers/f/8/t/3976 ...
user avatar
  • 1,303
0 votes
1 answer
43 views

Sitecore role in site1 when installed to site2, missing some restrictions in site2

For the new developer role we restricted access to Development tools in source site.When this role is packaged and installed in target site, it has permission to Development tools. How do we fix this ...
user avatar
  • 317
2 votes
1 answer
172 views

Content and Experience Editor custom buttons - only show for certain roles

I've added a couple of custom buttons on the Publish Chunks of the Content and Experience Editors Publish Strips. Right now, these custom buttons show for everyone, but I only want them to show up for ...
user avatar
1 vote
2 answers
346 views

Can I safely disable HTTP methods DELETE and OPTIONS?

A recent security audit recommended that I disable the HTTP methods DELETE and OPTIONS. I am not opposed to doing this, but have been unable to find any documentation indicating that I can do so ...
user avatar
0 votes
2 answers
370 views

Access to Sitecore CM from outside network

Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page? My client wants to make content management available to external agencies (who are comfortable ...
user avatar
  • 21
2 votes
2 answers
459 views

Check if a user is disabled

We have some custom code to send emails out when submitting an item from one workflow state to another and it seems to be sending items to users who have been disabled. I've been trying to find a way ...
user avatar
  • 1,045
0 votes
2 answers
581 views

Sitecore API key shown in Network tab

As you can see in the image above, the API key is clearly visible to all people to see. If you simply follow the URL you get the message: { "errors": [ { "message": "No query ...
user avatar
  • 11
4 votes
1 answer
463 views

Checklist for Sitecore Security Hardening using Azure PaaS

I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link - https://doc.sitecore.com/...
user avatar

1
2 3 4 5