Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
0
votes
1answer
126 views

Manage security access for items with GraphQL

We noticed that there is no limitation on what data can be queried, all the data in GraphQL can be retrieved within the Sitecore instance. Any GraphQL request with the correct API Key can retrieve ...
7
votes
2answers
2k views

Update user password programmatically

I am working on forgot password functionality. I use default sitecore user provider. How I can update user password programmatically? Is it possible to change password by manipulation with object of ...
0
votes
2answers
41 views

I packaged a bunch of roles but when seen in next environment, the security access and options did not translate in the next environment

I spent a good deal of time creating a series of roles to highly limit access to content items depending on the role. I did not want to go through the same exercise again when I moved from the DEV ...
0
votes
1answer
15 views

How to restrict the Security access for Sitecore Contextual ribbons

Have created a contextual ribbon and added the same to the standard values of my desired Template. The functionality is working good. But I wish to restrict the access of this Ribbon to only few ...
4
votes
3answers
269 views

Allow hyphens for Sitecore security roles?

We are implementing a customer's membership and roles database that is used in multiple applications. They have used hyphen in the role names, which is generally allowed but Sitecore does not allow by ...
1
vote
0answers
29 views

After deleting user, cannot immediately reuse username

This is Sitecore 9.1.1, and we're working with doing some test runs on user creation. Basically folks are creating users to log into the front end of the site, but they're sometimes not picking the ...
1
vote
1answer
192 views

Sitecore 9.2 Virtual User Authentication and SessionId Cookie [closed]

On the project I'm working on, we have chosen to use Sitecore 9.2 XM with Identity Server disabled. Where in the pipeline should I expect to see the ASP.NET_SessionId cookie get generated to be sent ...
1
vote
2answers
403 views

Sitecore content delivery server security hardening anonymous access

I'm using Sitecore 8.0 update 6 and following Sitecore security hardening documentation. I'd like to redirect user when the request is made to https://www.foo.com/sitecore to https://www.foo.com/404. ...
0
votes
1answer
22 views

Editors cannot edit certain aspects of presentation details, such as a component's datasource or placeholder

I am working on an issue facing some Sitecore editors. These editors can edit items normally once it is locked to them but cannot edit certain aspects of presentation details of those items. If the ...
0
votes
0answers
14 views

What sitecore role groups to be used where user can see the details in Presentation Tab but cannot edit them [duplicate]

I am trying to create a role group where user have read access to all the items but can see the presentation details in read mode. I have gone through the below link where the question asked is ...
0
votes
0answers
26 views

Most roles from AD Connector don't show in Security Editor

I'm attempting to sort out security permissions in our 8.1u3 installation, but I've run into a curious snag: we use the Active Directory connector to pull in all of the users and security groups from ...
3
votes
1answer
410 views

500 Error Page for HTTPS connection in Sitecore JSS in Connected Mode

I'm trying to implement user authentication login and currently trying out to configure JSS connected mode to work with https (secure connection). Following https://jss.sitecore.com/docs/techniques/...
1
vote
0answers
52 views

Setting language read access for endusers

We have followed this excellent guide: https://briancaos.wordpress.com/2010/06/30/setting-up-security-on-languages-in-sitecore-6/ for setting up security in the Sitecore client for our Sitecore ...
0
votes
0answers
25 views

Sitecore PowerShell access allow/deny at same time

Hello Sitecore SPE Experts, I have a very basic question, hope anyone help me: I am using something like below Add-ItemAcl -Path master:\content\home -AccessRight "item:read" -PropagationType Any - ...
2
votes
2answers
367 views

Secure Azure SQL database connection using a managed identity

We are currently hosting our Sitecore 9.1 initial release on premises, but want to move the complete solution into Azure. We want to use public services and not put our solution in an ASE. To secure ...
1
vote
0answers
60 views

Sitecore security patch notification

As we know sitecore release security patches sometime which needs to be applied ASAP. Is there any way so that whenever any critical security patch is released by sitecore , we will be notified. Do ...
0
votes
0answers
32 views

Language fallbacks and permissions conundrum

We have a multi-lingual site, with Global English (en) as the fallback language for all regional languages (eg: en-au defaults to en). The site has a shared architecture, whereby there's only a single ...
0
votes
0answers
25 views

Access to templates folder for non-admin users [duplicate]

I would like to give access to a user to a particular set of templates for editing, but I can't seem to do this. The user is not an admin, and no matter what I do I can't seem to have him see the ...
-1
votes
1answer
52 views

CM Server Phantom.js recommendation to move dataFolder does not work - has anyone implemented this?

I would like to know if the Sitecore Content Management Server security recommendation for phantom.js actually works? Has anyone successfully implemented it? I am specifically talking about the ...
22
votes
2answers
417 views

Can I encrypt the Sitecore Publishing Service connection strings?

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support ...
12
votes
2answers
2k views

WAF support with Sitecore Experience Platform

We are looking for a Web Application Firewall (WAF) solution for our Sitecore CMS implementation, because we are an Azure shop we specifically wanted to use the WAF feature on the Azure AppGateway ...
0
votes
1answer
43 views

Role required to display Add an account dialog

Which of the standard Sitecore roles is required for a CMS user to view the 'Add an account' dialog via the Content Editor? Any Item > Security > Assign security Adding the user to the sitecore\...
14
votes
2answers
2k views

Hiding items in the Content Editor for certain users / roles

The content editors want to divide up their roles so that some editors of the site only have access to edit and change a certain area of the site (e.g. /news and all its descendants). These editors ...
7
votes
2answers
519 views

How can I make the Edit the related item menu show in Experience Editor?

I am setting permissions for content editors of a site. The user in question is a member of the following roles: sitecore\Sitecore Client Users sitecore\Author sitecore\Sitecore Client Social ...
3
votes
1answer
151 views

Sitecore Password setting configuration

We are on 6.3.1 rev. 110112 and We have some specific requirements for setting up the password in Sitecore from the client side. For Example, we have the following requirements for the password ...
0
votes
1answer
156 views

Allowing custom role to move items

So according to this article it was a case of jumping into the Core database and setting read and write permissions on the Move To item. https://community.sitecore.net/developers/f/8/t/3976 ...
2
votes
2answers
63 views

How to grant bucket sync permission to role

I have a custom bucket that organizes items using a custom rule based on the value of a date field called "Event Start Date" on each page item. I'm trying to give content authors the ability to ...
10
votes
2answers
5k views

Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)

I was having an issue on a clients Staging environment where I was trying to use the Sitecore Item API to get items and I was getting an 403 error. It worked fine locally, I have a login method that ...
1
vote
1answer
245 views

The form was not loaded due to an error. 401 403 unauthorized

Using custom roles setup to lockdown access. Gave access rights to the Forms folder and the app menu for the launchpad. However I receive the error on the GUI after clicking one of the forms to open ...
2
votes
1answer
81 views

Content and Experience Editor custom buttons - only show for certain roles

I've added a couple of custom buttons on the Publish Chunks of the Content and Experience Editors Publish Strips. Right now, these custom buttons show for everyone, but I only want them to show up for ...
1
vote
0answers
48 views

What permissions does Sitecore need to manage Solr?

Solr 6.1.0 + Zookeeper + Basic Authentication Sitecore 8.0 Update-5 What are the minimum permissions required for Sitecore to manage Solr? The official documentation says nothing about this AFAICT ...
4
votes
2answers
137 views

JSS layout service, how to restrict public access

I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API. Please note, I am not taking about the login/logout ...
11
votes
2answers
3k views

What Role or Security Permission is required to edit the Placeholder and Datasource fields of a component?

We are setting up permission for users of our site, and have assigned our users to the roles sitecore\Sitecore Client Authoring and sitecore\Sitecore Client Designing. However this does not allow the ...
1
vote
1answer
121 views

Login virtual user to Sitecore Content Editor

Sitecore 8.2 I need to login virtual user with name like 'virtualUser2000' (not 'sitecore\virtualUser2000') to sitecore content editor. My code: var virtualUser = _authenticationManager....
0
votes
1answer
101 views

Writing an IIS rewrite rule for the Sitecore control panel URL

If I try to access http://mydomain.com/sitecore I get a 403 error. I would instead prefer for IIS to automatically redirect to https://mydomain.com/sitecore. I added the following rule in ...
2
votes
1answer
32 views

What are the consequences of an item locked in the web database?

While reviewing if an item was published in the Web database, I noticed some items showed the locked gutter icon. Is there a change in behavior with respect to viewing the published site if an item ...
3
votes
2answers
3k views

Troubleshooting “Could not create SSL/TLS secure channel” error in XConnect on Sitecore 9.1

I have a freshly-created Sitecore 9.1 instance. After setting up the xDB Migration Tool, I get the following error message when running the Troubleshooter: ERROR [Data Exchange] at Sitecore.Xdb....
7
votes
3answers
2k views

How do I control access to Custom Item Web API controllers?

I am creating a Web API (Controller) inside my Sitecore solution by inheriting ServicesApiController and EnableCors attribute. This service will be called from any IPhone/Android Application (...
2
votes
2answers
55 views

Securing the Sitecore client on a single server setup with CDN

On a single server setup for Sitecore which has a CDN in front of it how would you go about securing the Sitecore client. If there was no CDN I would implement IP security to block access to the ...
2
votes
1answer
59 views

What happens when you change the security domain setting for a site?

I was going through Sitecore domains documentation and found the link interesting. https://www.linkedin.com/pulse/what-importance-security-domains-sitecore-rohit-chopra Upon going through that, I ...
3
votes
1answer
286 views

Checklist for Sitecore Security Hardening using Azure PaaS

I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link - https://doc.sitecore.com/...
0
votes
1answer
41 views

Sitecore role in site1 when installed to site2, missing some restrictions in site2

For the new developer role we restricted access to Development tools in source site.When this role is packaged and installed in target site, it has permission to Development tools. How do we fix this ...
1
vote
2answers
156 views

Can I safely disable HTTP methods DELETE and OPTIONS?

A recent security audit recommended that I disable the HTTP methods DELETE and OPTIONS. I am not opposed to doing this, but have been unable to find any documentation indicating that I can do so ...
0
votes
2answers
196 views

Access to Sitecore CM from outside network

Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page? My client wants to make content management available to external agencies (who are comfortable ...
2
votes
2answers
209 views

Check if a user is disabled

We have some custom code to send emails out when submitting an item from one workflow state to another and it seems to be sending items to users who have been disabled. I've been trying to find a way ...
0
votes
1answer
85 views

How to define a new user role that can create and approve their OWN content only?

I have a requirement like a user should create and approve their OWN content only and it should not accessible that created/updated Sitecore items to other users. Ex: user1 has created a test1 page ...
0
votes
2answers
258 views

Sitecore API key shown in Network tab

As you can see in the image above, the API key is clearly visible to all people to see. If you simply follow the URL you get the message: { "errors": [ { "message": "No query ...
1
vote
1answer
68 views

Content authors to see their own items only in workbox, not from other authors

Is there a way to implement the workflow and user roles for Content authors to see their own items only in workbox not from other authors.
1
vote
0answers
106 views

Security Error Rebuilding Indexes

Sitecore 8.1 rev. 160302. Looking into my logfiles, there are lots of errors such as: Job Started: Index_Update_IndexName=RSearch ... Exception: System.NullReferenceException Message: Object ...
2
votes
1answer
212 views

Security Permissions - Individual inheritance rules set for this account

In my Sitecore instance some red text has appeared next to the Inheritance section in the Assign Security Rights dialog box (see screenshot below). "The item has individual inheritance rules set for ...

1
2 3 4 5