Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

0
votes
2answers
34 views

Sitecore redirects to no-access page instead of login page

I have the following site configuration for my Sitecore 9.1 site: <site name="the-website" patch:after="site[@name='modules_website']" language="en" ... ...
0
votes
1answer
39 views

Access denied page in Sitecore when using requireLogin

Our current site (Sitecore 9.1) configuration looks like this: (simplified for readability) <site name="the-website" patch:after="site[@name='modules_website']" language="en" ... ...
0
votes
0answers
16 views

The CSRF cookie value did not match the CSRF parameter value [duplicate]

I got an error while clicking the item in Sitecore, but when I refreshed the page, I was able to click the item this time. Exception: Sitecore.Security.AntiCsrf.Exceptions.PotentialCsrfException ...
0
votes
1answer
38 views

Troubleshooting “Could not create SSL/TLS secure channel” error in XConnect on Sitecore 9.1

I have a freshly-created Sitecore 9.1 instance. After setting up the xDB Migration Tool, I get the following error message when running the Troubleshooter: ERROR [Data Exchange] at Sitecore.Xdb....
2
votes
1answer
33 views

Is it possible to teach the keepalive agent to overcome TLS/SSL certificate warnings?

We have an internal environment where the TLS/SSL certificate on tenants is not playing well with some requests. This is not a huge issue for clients who can add a one time trust for the certificate, ...
2
votes
0answers
30 views

Resetting admin password with Sitecore 9.1.1 and Identity Server after SHA512 change [duplicate]

I'm going through the security hardening steps on a new, local instance of Sitecore 9.1.1 with identity server. I made the SHA512 change in the Sitecore web.config, and I ran the database script to ...
0
votes
1answer
30 views

Roles: regional author to edit certain “global” items based on template

We need to create a role that would: - generally be only able to edit content in specific language (i.e fr-fr, regional author) - except items based on template A where they also should be able to ...
1
vote
1answer
35 views

Give Role permissions to add Url Redirects in System folder

I need to give a content author permissions to add url redirects to the folder /sitecore/system/Modules/Redirect Module, but I don't want to make them an administrator. How do I do that? I've tried ...
1
vote
1answer
92 views

JWT tokens for authentication for 9.0 UPDATE 1

I have an instance running SxC 9.0 update 1. I was working on an API which had to be consumed by a 3rd party application. Can you provide some input for using token bear mechanism to protect my API. ...
1
vote
0answers
53 views

Security Error Rebuilding Indexes

Sitecore 8.1 rev. 160302. Looking into my logfiles, there are lots of errors such as: Job Started: Index_Update_IndexName=RSearch ... Exception: System.NullReferenceException Message: Object ...
0
votes
0answers
51 views

Admin not able to restore deleted pages

I am facing issue while restoring deleted pages in sitecore. The page which is deleted by author was not able to restore by admin.Please refer below screenshot for error while restore... Thanks in ...
2
votes
1answer
28 views

Can you setup security trimming with code first JSS?

We want to restrict some pages that are behind a login on a JSS site. We use code-first development. Is is possible to setup the security in the /data/*.yml files? Or should we update the security ...
1
vote
1answer
61 views

How to check access right in SitecoreController for Sitecore 9.1

In my JSON controller I want to check the access right from the User. My code looks like this public class MyController : SitecoreController { public static bool CheckAccessRight() { ...
1
vote
1answer
38 views

Setup security for the Sitecore SXA site multiple times

When we try to add the Security Setting to the site for the first time we are able to run the Setup Security script with the link under Scripts. When we tried to make changes again in the security, ...
5
votes
0answers
57 views

How to enable custom hashing algorithm on identity server?

I have sitecore 9.1 and I added pipeline which add new hashing algorithm (pbkdf2 implementation from Zetetic team with 5000 iterations) to CryptoConfig and changed hashAlgorithmType to pbkdf2 in ...
1
vote
2answers
91 views

Security Hardening in PaaS

We are using Sitecore 9.0.2 deployed in PaaS as a general recommendation from Sitecore Security Hardening Guide perspective we are supposed to do the below items: 1)Prevent Anonymous Users access to ...
1
vote
1answer
35 views

Work Flow Security Permissions

I have a template and apply Publishing workflow on this template, I created items from this template in 2 different sites, I created 2 different users for each site,I want when the item in "site 1" ...
4
votes
1answer
137 views

IsAdministrator check no longer working on Sitecore 9.1

I created a few pages within our Sitecore setup to be accessed only by the Sitecore administrator while our site was still running on 8.2, using Sitecore.Context.IsAdministrator to check if the user ...
1
vote
1answer
62 views

Secure Azure SQL database connection using a managed identity

We are currently hosting our Sitecore 9.1 initial release on premises, but want to move the complete solution into Azure. We want to use public services and not put our solution in an ASE. To secure ...
3
votes
1answer
91 views

Sitecore 9.1 password complexity

It seems that Sitecore 9.1, with the new Identity Server, no longer uses the same way of configuring password complexity as the previous versions. Some of the links that I found related to 9.0 and ...
1
vote
1answer
46 views

Remove certain items from control panel for some users

I have users that I would like only to see the My Settings section in the Control Panel and hide the Administration, Database, Reports, Localization, and Security items. I've been looking in the Core ...
2
votes
1answer
109 views

How to fetch users in particular domain programmatically in Sitecore9

We recently upgraded our project to Sitecore9 initial release from 7.2. We were re-compiling our code including latest Sitecore.Kernel. We got this error: error CS0117: 'Factory' does not contain a ...
1
vote
1answer
33 views

Give access to Archive button in Launchpad

I'm trying to add a button to the Archive tool in the launchpad. I think I've granted access to the role the user is in - to \applications\archives and everything under it, but I think I'm missing ...
0
votes
0answers
73 views

Not seeing insert options for user

I'm trying to set up a new set of users with roles. I have them members of a couple of different roles that inherit from sitecore roles, including Author, Designer, Sitecore Client Designer and ...
0
votes
1answer
31 views

Not able to change Referrer Policy in Sitecore SXA Site

We have been trying to change Referrer Policy to 'no-referrer' but no luck. Below are the following approaches we followed for quick verification: Adding the following tag in head section of ...
4
votes
2answers
132 views

Sitecore CD instance - Restrict access to Sitecore folder without blocking keepalive.aspx?

I have a CD/CM site which I hardened by restricting access to Sitecore by adding "sitecore" to the Hidden Segments in the Request Filtering section in IIS (second answer here). However, this has ...
6
votes
2answers
171 views

You do not have permission to create an item here (Local Datasources)

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by ...
2
votes
1answer
94 views

Securing Sitecore 9.0.2 PAAS xDB & xConnect Server Role Services

We are using Sitecore 9.0.2 PAAS on Azure and we found that below server roles are not on https instead they are on http xDB Role Services Processing (prc) Reporting (rep) xConnect Server Role ...
22
votes
1answer
280 views

Can I encrypt the Sitecore Publishing Service connection strings?

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support ...
0
votes
1answer
75 views

Unable to fetch item using getitem method

I was trying to access item using getitem method from SOAP service. Sitecore.Data.Items.Item item = Sitecore.context.Database.GetItem(<ID>) But Item is null. I tried to fetch using Id and path ...
1
vote
2answers
313 views

Where are the access rights stored for security roles in serialized files?

When we create security roles and assign access rights, corresponding serialized files for role get created. But when we look at the files we don't see any data related to access rights. So just ...
0
votes
1answer
31 views

Determine access rights of a user in a particular role

I want to fetch access rights of a user to an item who has been under a security role. I am controlling the access to that particular item by adding the user to that role. Can someone help how I can ...
2
votes
3answers
92 views

How to Transfer Users with active password policy

I want to transfer users from our QA environment to the PROD environment on Sitecore.NET 8.2 (rev. 170728). It is totally fine if the users are deactivated and have a random password set. ...
1
vote
1answer
118 views

Inheriting Sitecore Roles

I have a role "Editor" which is having certain permissions and don't have read access to Sitecore/Social item. Now i need to create a new role "Approver" which is having same access as Editor but ...
1
vote
1answer
60 views

Sitecore roles required for content testing

I'm using Sitecore 8.2 Update 7 and I'm trying to restrict access to my Sitecore Content Editors. One of them wants to run a content test using the built-in testing controls. When I go to "Create a ...
4
votes
3answers
132 views

How to identify which users have access to particular item?

I want to know the users who all have access Read/Write to particular item. How to fetch that info? is there any SQL table to extract?
0
votes
0answers
67 views

Combination of multiple roles

We have a multi-app multi-site app structure like follows: Commerce BE Pages Feature 1 Feature 2 DE Pages Feature 1 Feature 2 NL Pages Feature 1 Feature 2 ...
0
votes
1answer
50 views

Page Creation role in Sitecore Habitat

In the Sitecore Habitat implementation, I am looking for a role that is allowed to create/rename and delete items. I see the role habitat\Project Habitat Content Author, that is only allowed to read ...
2
votes
2answers
66 views

List of recommended patches for specific Sitecore version

Is there an easy way to find a list of recommended patches for a specific Sitecore version/update? I can see that individual patches are recommended for a particular version but I can't find a a list ...
0
votes
1answer
76 views

Disabling the Autocomplete in WFFM

Is there a possibility to disable the autocomplete of Sitecore WFFM text box. We are using Sitecore 8.1
1
vote
1answer
75 views

The form was not loaded due to an error. 401 403 unauthorized

Using custom roles setup to lockdown access. Gave access rights to the Forms folder and the app menu for the launchpad. However I receive the error on the GUI after clicking one of the forms to open ...
1
vote
0answers
228 views

Can I use self-signed certificates for xConnect, Solr, and Sitecore Commerce in a Sitecore 9 XP0 production deployment?

I am planning a small Sitecore 9.0.2 + Sitecore Experience Commerce production deployment for a demo website with very low traffic. I do not have a lot of time to provision multiple servers, so I plan ...
0
votes
0answers
37 views

Why is SHA512 not the default memberschip hash algorithm?

By default, when you install Sitecore (9), the default encryption algorith for the membership provider is SHA1. The security guidelines state to change this to the strongen SHA512 algorithm. Is ...
10
votes
1answer
300 views

X-Frame Option in Sitecore 9

I have added the following X-frame-options header in web.config: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> <add name="X-Frame-Options" value="...
1
vote
1answer
89 views

Sitecore security hardening Paas [closed]

We have setup a Paas enviroment with Sitecore 9.0.1 XP scaled. The problem is that Sitecore login and admin tools are available on the Content Delivery server. My understanding is that Security ...
3
votes
1answer
100 views

Decreasing security rights on sitecore role

I have a role which is inheriting for other roles (one of which is sitecore\Designer). The role now has all access rights to Templates and its sub items. Now I want to reduce the access rights such ...
2
votes
1answer
87 views

Sitecore Password setting configuration

We are on 6.3.1 rev. 110112 and We have some specific requirements for setting up the password in Sitecore from the client side. For Example, we have the following requirements for the password ...
2
votes
1answer
51 views

How can I copy security fields between environments?

How can I copy security fields between environments? I can't use TDS serialization because there are too many changes that would be propagated. Is it possible to simply only copy the security fields?...
4
votes
2answers
127 views

Allow hyphens for Sitecore security roles?

We are implementing a customer's membership and roles database that is used in multiple applications. They have used hyphen in the role names, which is generally allowed but Sitecore does not allow by ...
5
votes
1answer
102 views

Multisite publishing issue in SXA

Using SXA 1.6 and Sitecore 9.0.1 , we have an environment with single tenant and multi sites ex: site1 , site2 ,.. we setup OOB security so only users in site1 can edit their content only and same for ...