Questions tagged [security]
Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.
223
questions
1
vote
0answers
28 views
After deleting user, cannot immediately reuse username
This is Sitecore 9.1.1, and we're working with doing some test runs on user creation. Basically folks are creating users to log into the front end of the site, but they're sometimes not picking the ...
0
votes
1answer
21 views
Editors cannot edit certain aspects of presentation details, such as a component's datasource or placeholder
I am working on an issue facing some Sitecore editors.
These editors can edit items normally once it is locked to them but cannot edit certain aspects of presentation details of those items. If the ...
0
votes
0answers
14 views
What sitecore role groups to be used where user can see the details in Presentation Tab but cannot edit them [duplicate]
I am trying to create a role group where user have read access to all the items but can see the presentation details in read mode.
I have gone through the below link where the question asked is ...
0
votes
0answers
26 views
Most roles from AD Connector don't show in Security Editor
I'm attempting to sort out security permissions in our 8.1u3 installation, but I've run into a curious snag: we use the Active Directory connector to pull in all of the users and security groups from ...
0
votes
0answers
24 views
Sitecore PowerShell access allow/deny at same time
Hello Sitecore SPE Experts,
I have a very basic question, hope anyone help me:
I am using something like below
Add-ItemAcl -Path master:\content\home -AccessRight "item:read" -PropagationType Any -
...
1
vote
0answers
52 views
Setting language read access for endusers
We have followed this excellent guide: https://briancaos.wordpress.com/2010/06/30/setting-up-security-on-languages-in-sitecore-6/ for setting up security in the Sitecore client for our Sitecore ...
1
vote
0answers
59 views
Sitecore security patch notification
As we know sitecore release security patches sometime which needs to be applied ASAP. Is there any way so that whenever any critical security patch is released by sitecore , we will be notified.
Do ...
0
votes
0answers
31 views
Language fallbacks and permissions conundrum
We have a multi-lingual site, with Global English (en) as the fallback language for all regional languages (eg: en-au defaults to en). The site has a shared architecture, whereby there's only a single ...
0
votes
0answers
25 views
Access to templates folder for non-admin users [duplicate]
I would like to give access to a user to a particular set of templates for editing, but I can't seem to do this.
The user is not an admin, and no matter what I do I can't seem to have him see the ...
-1
votes
1answer
48 views
CM Server Phantom.js recommendation to move dataFolder does not work - has anyone implemented this?
I would like to know if the Sitecore Content Management Server security recommendation for phantom.js actually works? Has anyone successfully implemented it?
I am specifically talking about the ...
0
votes
1answer
41 views
Role required to display Add an account dialog
Which of the standard Sitecore roles is required for a CMS user to view the 'Add an account' dialog via the Content Editor?
Any Item > Security > Assign security
Adding the user to the sitecore\...
2
votes
2answers
58 views
How to grant bucket sync permission to role
I have a custom bucket that organizes items using a custom rule based on the value of a date field called "Event Start Date" on each page item.
I'm trying to give content authors the ability to ...
0
votes
1answer
115 views
Manage security access for items with GraphQL
We noticed that there is no limitation on what data can be queried, all the data in GraphQL can be retrieved within the Sitecore instance.
Any GraphQL request with the correct API Key can retrieve ...
1
vote
0answers
48 views
What permissions does Sitecore need to manage Solr?
Solr 6.1.0 + Zookeeper + Basic Authentication
Sitecore 8.0 Update-5
What are the minimum permissions required for Sitecore to manage Solr?
The official documentation says nothing about this AFAICT ...
4
votes
2answers
125 views
JSS layout service, how to restrict public access
I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API.
Please note, I am not taking about the login/logout ...
1
vote
1answer
109 views
Login virtual user to Sitecore Content Editor
Sitecore 8.2
I need to login virtual user with name like 'virtualUser2000' (not 'sitecore\virtualUser2000') to sitecore content editor.
My code:
var virtualUser = _authenticationManager....
2
votes
1answer
32 views
What are the consequences of an item locked in the web database?
While reviewing if an item was published in the Web database, I noticed some items showed the locked gutter icon.
Is there a change in behavior with respect to viewing the published site if an item ...
0
votes
1answer
99 views
Writing an IIS rewrite rule for the Sitecore control panel URL
If I try to access http://mydomain.com/sitecore I get a 403 error.
I would instead prefer for IIS to automatically redirect to https://mydomain.com/sitecore.
I added the following rule in ...
2
votes
2answers
55 views
Securing the Sitecore client on a single server setup with CDN
On a single server setup for Sitecore which has a CDN in front of it how would you go about securing the Sitecore client.
If there was no CDN I would implement IP security to block access to the ...
1
vote
1answer
180 views
Sitecore 9.2 Virtual User Authentication and SessionId Cookie [closed]
On the project I'm working on, we have chosen to use Sitecore 9.2 XM with Identity Server disabled. Where in the pipeline should I expect to see the ASP.NET_SessionId cookie get generated to be sent ...
2
votes
1answer
59 views
What happens when you change the security domain setting for a site?
I was going through Sitecore domains documentation and found the link interesting.
https://www.linkedin.com/pulse/what-importance-security-domains-sitecore-rohit-chopra
Upon going through that, I ...
0
votes
1answer
143 views
Allowing custom role to move items
So according to this article it was a case of jumping into the Core database and setting read and write permissions on the Move To item.
https://community.sitecore.net/developers/f/8/t/3976
...
0
votes
1answer
41 views
Sitecore role in site1 when installed to site2, missing some restrictions in site2
For the new developer role we restricted access to Development tools in source site.When this role is packaged and installed in target site, it has permission to Development tools. How do we fix this ...
2
votes
1answer
79 views
Content and Experience Editor custom buttons - only show for certain roles
I've added a couple of custom buttons on the Publish Chunks of the Content and Experience Editors Publish Strips. Right now, these custom buttons show for everyone, but I only want them to show up for ...
1
vote
2answers
138 views
Can I safely disable HTTP methods DELETE and OPTIONS?
A recent security audit recommended that I disable the HTTP methods DELETE and OPTIONS.
I am not opposed to doing this, but have been unable to find any documentation indicating that I can do so ...
0
votes
2answers
186 views
Access to Sitecore CM from outside network
Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page?
My client wants to make content management available to external agencies (who are comfortable ...
2
votes
2answers
193 views
Check if a user is disabled
We have some custom code to send emails out when submitting an item from one workflow state to another and it seems to be sending items to users who have been disabled. I've been trying to find a way ...
0
votes
2answers
239 views
Sitecore API key shown in Network tab
As you can see in the image above, the API key is clearly visible to all people to see. If you simply follow the URL you get the message:
{
"errors": [
{
"message": "No query ...
3
votes
1answer
274 views
Checklist for Sitecore Security Hardening using Azure PaaS
I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link -
https://doc.sitecore.com/...
1
vote
1answer
66 views
Content authors to see their own items only in workbox, not from other authors
Is there a way to implement the workflow and user roles for Content authors to see their own items only in workbox not from other authors.
0
votes
1answer
78 views
How to define a new user role that can create and approve their OWN content only?
I have a requirement like a user should create and approve their OWN content only and it should not accessible that created/updated Sitecore items to other users.
Ex: user1 has created a test1 page ...
2
votes
1answer
197 views
Security Permissions - Individual inheritance rules set for this account
In my Sitecore instance some red text has appeared next to the Inheritance section in the Assign Security Rights dialog box (see screenshot below). "The item has individual inheritance rules set for ...
3
votes
1answer
377 views
500 Error Page for HTTPS connection in Sitecore JSS in Connected Mode
I'm trying to implement user authentication login and currently trying out to configure JSS connected mode to work with https (secure connection).
Following https://jss.sitecore.com/docs/techniques/...
0
votes
2answers
1k views
Sitecore redirects to no-access page instead of login page
I have the following site configuration for my Sitecore 9.1 site:
<site name="the-website" patch:after="site[@name='modules_website']"
language="en"
...
...
0
votes
1answer
202 views
Access denied page in Sitecore when using requireLogin
Our current site (Sitecore 9.1) configuration looks like this: (simplified for readability)
<site name="the-website" patch:after="site[@name='modules_website']"
language="en"
... ...
0
votes
0answers
140 views
The CSRF cookie value did not match the CSRF parameter value [duplicate]
I got an error while clicking the item in Sitecore, but when I refreshed the page, I was able to click the item this time.
Exception:
Sitecore.Security.AntiCsrf.Exceptions.PotentialCsrfException
...
3
votes
2answers
2k views
Troubleshooting “Could not create SSL/TLS secure channel” error in XConnect on Sitecore 9.1
I have a freshly-created Sitecore 9.1 instance.
After setting up the xDB Migration Tool, I get the following error message when running the Troubleshooter:
ERROR [Data Exchange] at Sitecore.Xdb....
3
votes
1answer
145 views
Is it possible to teach the keepalive agent to overcome TLS/SSL certificate warnings?
We have an internal environment where the TLS/SSL certificate on tenants is not playing well with some requests. This is not a huge issue for clients who can add a one time trust for the certificate, ...
3
votes
0answers
144 views
Resetting admin password with Sitecore 9.1.1 and Identity Server after SHA512 change [duplicate]
I'm going through the security hardening steps on a new, local instance of Sitecore 9.1.1 with identity server. I made the SHA512 change in the Sitecore web.config, and I ran the database script to ...
0
votes
1answer
32 views
Roles: regional author to edit certain “global” items based on template
We need to create a role that would:
- generally be only able to edit content in specific language (i.e fr-fr, regional author)
- except items based on template A where they also should be able to ...
1
vote
1answer
101 views
Give Role permissions to add Url Redirects in System folder
I need to give a content author permissions to add url redirects to the folder /sitecore/system/Modules/Redirect Module, but I don't want to make them an administrator. How do I do that?
I've tried ...
1
vote
1answer
544 views
JWT tokens for authentication for 9.0 UPDATE 1
I have an instance running SxC 9.0 update 1.
I was working on an API which had to be consumed by a 3rd party application.
Can you provide some input for using token bear mechanism to protect my API.
...
1
vote
0answers
104 views
Security Error Rebuilding Indexes
Sitecore 8.1 rev. 160302.
Looking into my logfiles, there are lots of errors such as:
Job Started: Index_Update_IndexName=RSearch
...
Exception: System.NullReferenceException
Message: Object ...
0
votes
0answers
62 views
Admin not able to restore deleted pages
I am facing issue while restoring deleted pages in sitecore. The page which is deleted by author was not able to restore by admin.Please refer below screenshot for error while restore...
Thanks in ...
2
votes
1answer
39 views
Can you setup security trimming with code first JSS?
We want to restrict some pages that are behind a login on a JSS site. We use code-first development.
Is is possible to setup the security in the /data/*.yml files? Or should we update the security ...
1
vote
1answer
155 views
How to check access right in SitecoreController for Sitecore 9.1
In my JSON controller I want to check the access right from the User.
My code looks like this
public class MyController : SitecoreController
{
public static bool CheckAccessRight()
{
...
1
vote
1answer
71 views
Setup security for the Sitecore SXA site multiple times
When we try to add the Security Setting to the site for the first time we are able to run the Setup Security script with the link under Scripts.
When we tried to make changes again in the security, ...
7
votes
0answers
317 views
How to enable custom hashing algorithm on identity server?
I have sitecore 9.1 and I added pipeline which add new hashing algorithm (pbkdf2 implementation from Zetetic team with 5000 iterations) to CryptoConfig and changed hashAlgorithmType to pbkdf2 in ...
1
vote
2answers
330 views
Security Hardening in PaaS
We are using Sitecore 9.0.2 deployed in PaaS as a general recommendation from Sitecore Security Hardening Guide perspective we are supposed to do the below items:
1)Prevent Anonymous Users access to ...
1
vote
1answer
41 views
Work Flow Security Permissions
I have a template and apply Publishing workflow on this template, I created items from this template in 2 different sites, I created 2 different users for each site,I want when the item in "site 1" ...
