Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
37
votes
5answers
16k views

Is there a way to reset Sitecore admin password from database level?

I forgot my Sitecore admin password and was thinking a way to reset from database level. Is there a SQL query to reset Sitecore admin password ?
26
votes
2answers
663 views

Restricting Item Access Rights to Roles - Prevent Users from being assigned Access Rights directly

Best practice is to assign access rights to roles rather than users. So I would like to block changes that apply access rights for users. Sitecore does not seem to trigger the saveUI pipeline on ...
23
votes
5answers
6k views

How do I disable /sitecore access on a Content Delivery Server?

I have 2 servers: Content Delivery - the live site pointing to the web database. Content Management - the internal only site pointing to the master database. I want to prevent access to /sitecore on ...
22
votes
1answer
338 views

Can I encrypt the Sitecore Publishing Service connection strings?

Is there a way to encrypt the connection strings of the Sitecore Publishing Service? I don't want the connection strings to stay in clear text on the server, nor leave the system in Sitecore support ...
17
votes
3answers
3k views

Does Sitecore support SAML?

I'm aware of and have successfully used the AD module for numerous Sitecore implementations but I have a requirement to support SAML so that a non-AD based authentication provider can be used. Does ...
15
votes
3answers
4k views

How to unlock the Sitecore admin user account?

I know you can unlock normal Sitecore users from user manager by login in to Sitecore backend, as admin user. Is there any way to unlock Sitecore admin user, when the user account gets locked?
14
votes
2answers
389 views

Sitecore Trivia - Anyone know the story behind admin / b username/password?

Who originally picked admin / b username and password combo? Is there a story a behind it? Why b? I'm just curious if there is a story behind it.
14
votes
2answers
2k views

How to prevent a cookie replay attack?

As a result of a security audit, we must prevent an attacker from being able to do a cookie replay attack. Apparently this weakness has been around in the .NET framework for ages. There is also an old ...
14
votes
2answers
2k views

Hiding items in the Content Editor for certain users / roles

The content editors want to divide up their roles so that some editors of the site only have access to edit and change a certain area of the site (e.g. /news and all its descendants). These editors ...
12
votes
2answers
2k views

WAF support with Sitecore Experience Platform

We are looking for a Web Application Firewall (WAF) solution for our Sitecore CMS implementation, because we are an Azure shop we specifically wanted to use the WAF feature on the Azure AppGateway ...
11
votes
4answers
6k views

MediaRequestProtection: An invalid/missing hash value was encountered

My Sitecore error logs contain messages such as: ERROR MediaRequestProtection: An invalid/missing hash value was encountered. The expected hash value... What would be causing this? This is only ...
11
votes
1answer
971 views

How do you best manage security domains using SXA with the Active Directory module?

SXA provides the ability to create new tenants on-the-fly. Ideally each tenant would have a unique set of roles such as tenant1\admin and tenant1\editor. How do you configure roles and domains in ...
11
votes
1answer
651 views

X-Frame Option in Sitecore 9

I have added the following X-frame-options header in web.config: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> <add name="X-Frame-Options" value="...
11
votes
2answers
3k views

What Role or Security Permission is required to edit the Placeholder and Datasource fields of a component?

We are setting up permission for users of our site, and have assigned our users to the roles sitecore\Sitecore Client Authoring and sitecore\Sitecore Client Designing. However this does not allow the ...
11
votes
1answer
264 views

AD Module over SSL

According to https://kb.sitecore.net/articles/886061 the AD module does not fully support SSL: The SitecoreADMembershipProvider provider supports SSL connection. This provider is based on System.Web....
10
votes
3answers
602 views

SQL user creation is setting password of 12345, fails deployment

Using the updated Sitecore Azure Toolkit 2.0.1 rev. 171218, which has resources for 9.0.1, I'm hitting an error on the xc-collect\MSDeploy stage where it's attempting to apply the default sql user ...
10
votes
1answer
187 views

After applying the Q3 2016 Security Update our sites went down

As you all might know Sitecore issued a critical security hotfix, after applying the fix to our client sites, most of them went down for on average 30 minutes before going back up again, and one of ...
10
votes
0answers
130 views

Parameter Template Security Oddity

I experienced a weird issue and was wondering if anyone has seen this. I had to lock down Templates and Renderings to be read only for content authors so a "Publish Related Items" would not publish ...
9
votes
1answer
4k views

Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)

I was having an issue on a clients Staging environment where I was trying to use the Sitecore Item API to get items and I was getting an 403 error. It worked fine locally, I have a login method that ...
9
votes
3answers
5k views

Best practices for HTTP Denial of Service configuration

A security audit has been performed for Sitecore setup. One of the issues revealed is about "HTTP Denial of Service" Description: A malicious user with a computer can send a specially crafted ...
9
votes
1answer
153 views

Do we have any security risk for exposing page Item GUID?

We have number of article pages in our site. I am trying to create article RSS feed specifically for Facebook Instant Articles consumption. As per their documentation, each item in feed should have ...
8
votes
4answers
632 views

Why does Sitecore insist on generating a new password to provide the 'old' password, when setting a new password

If I need to change a Sitecore user's password, the dialog requires that I submit the old password at the same time. Often I don't know the old password, so within the same dialog I can generate a new ...
8
votes
3answers
368 views

How to change the domain of a custom role?

I have created some custom Roles under the "sitecore" domain, but now I want to migrate all the custom roles to another domain e.g. fancy_domain\Cool_Role. How to do it?
8
votes
3answers
2k views

Sitecore access to an Item based on role

I have a Sitecore application, and some of my content authors want to work on some "secret pages" that should not be available to anyone else, including other content authors. Only a few of the ...
8
votes
1answer
562 views

How do I set password complexity?

I need to change the password complexity requirements for authors to meet corporate standards of a password being: Minium of 8 characters Contain at least one numeral Contain at least one symbol
8
votes
1answer
691 views

Force Password Expiration

I used this before Sitecore 8 to force users to reset their passwords if they are past a certain date. I've been given this task again in Sitecore 8. It looks like the new change password page ...
7
votes
4answers
4k views

How to check access permissions on items for a user via the Security API?

I am trying to check Read permission for the current user on a specific item like the following: Sitecore.Data.Database.GetDatabase("master") .SelectItems("/sitecore/content/Settings/Item1")[0] ...
7
votes
5answers
1k views

How do you setup your local Sitecore instance to support HTTPS in either a single or multi-tenant configuration?

I'm using SXA and have found that while using the Maps and Location Finder component that the utodetect location feature is no longer available for insecure origins. You may see an error such as this ...
7
votes
2answers
2k views

Update user password programmatically

I am working on forgot password functionality. I use default sitecore user provider. How I can update user password programmatically? Is it possible to change password by manipulation with object of ...
7
votes
1answer
622 views

Technical vulnerability details on Sitecore critical vulnerability (SC2016-001-128003) [closed]

What are the technical vulnerability which are covered by the critical vulnerability (SC2016-001-128003)? The KB article doesn't cover what the vulnerability is.
7
votes
3answers
2k views

How do I control access to Custom Item Web API controllers?

I am creating a Web API (Controller) inside my Sitecore solution by inheriting ServicesApiController and EnableCors attribute. This service will be called from any IPhone/Android Application (...
7
votes
1answer
744 views

AntiForgery Tokens and Sitecore Development

I have set up some Sitecore extranet users (8.1.160519). I am using MVC AntiForgeryTokens for some posts. The problem is with the login form explicitly. When I am developing I am logged in as Admin ...
7
votes
1answer
157 views

Do I need to apply SC2016-001-128003 to 8.2 Update-1?

The article says only Initial Release of 8.2 is affected but doesn't say Update 1 is not vulnerable.
7
votes
2answers
441 views

How can I make the Edit the related item menu show in Experience Editor?

I am setting permissions for content editors of a site. The user in question is a member of the following roles :- sitecore\Sitecore Client Users sitecore\Author sitecore\Sitecore Client Social ...
7
votes
1answer
604 views

Sitecore Powershell Extensions - Reports Authorization

I've created some PSE scripts to give our client some reports on their content. I created them under the proper convention of Script Module and Script Library so that the reports show up under ...
7
votes
1answer
860 views

Edit after workflow approved

I just watched a tutorial on how to set up Workflows here: https://www.youtube.com/watch?v=hFDUgiQCTmU&list=PLfRWjEN_vCUZqAk8ks5j36yM-BCWup-SZ&index=1#t=35m58s I followed this tutorial ...
7
votes
3answers
557 views

Sitecore xDB Stale data encryption (always encrypted)

As Sitecore 9 is all about Data security, clear seperation and so on, we would obviously like to put those features to work. That is why we were wondering how the Stale data encryption that was ...
7
votes
1answer
370 views

How to best use Roles and Domains with Multi-site SSO

Background We have an upcoming multi-site project, in which our client would like us to implement a "restricted" SSO wherein the users of mainsite.com that have been given access to employees....
6
votes
2answers
305 views

You do not have permission to create an item here (Local Datasources)

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by ...
6
votes
1answer
333 views

How do I configure a custom security domain so that it doesn't need to be specified when logging in?

I have a custom security domain that has a majority of content authors in it. I feel like, there is a way, so that rather than optionally having to type in sitecore\user, you can make your custom ...
6
votes
1answer
451 views

Restricting access to particular page returns 404 instead of redirecting to login

I'm trying to restrict access to a particular page, I've already read everything possible on the matter but instead of redirecting to login page Sitecore is returning a 404. I've set the loginPage="/...
6
votes
1answer
277 views

Setting up automated role creation for various SXA sites

The challenge I am trying to solve is to create dynamic roles for an SXA site, knowing that my client will be creating multiple SXA sites over time, and thinking that possibly the best way to ...
6
votes
1answer
179 views

Role will not be installed as it already exists

I have created a sitecore security accounts package with an updated permissions on roles. When i try to install it, its says "Role will not be installed as it already exists". Is that mean i can't ...
6
votes
2answers
805 views

Restricting certain users with read-only access to core and web database?

I am looking into access viewer in Sitecore. My goal is to restrict certain users with just read-only access to core and web database. However these users need to have a write access to some items in ...
6
votes
2answers
427 views

How to obtain a certificate from a certified authority for Sitecore 9 Installation?

I am planning to deployed Sitecore 9 Update 1 on Azure PaaS using Sitecore Marketplace template. I have created the non-production environment like SIT,QA,UAT using self signed certificate option and ...
6
votes
2answers
254 views

Remove access to Shared presentation?

I am trying to remove access to shared presentation for a particular role. I have denied read on this item: /sitecore/content/Applications/WebEdit/Ribbons/Chunks/Layout Modes/Shared Layout. This ...
6
votes
1answer
486 views

Sitecore Logs shows The current user cannot be resolved from the authentication cookie

Sitecore logs are showing lot of these messages: WARN The current user cannot be resolved from the authentication cookie. The cookie will be removed. Ex: Line 556: 1820 07:14:48 WARN The ...
6
votes
2answers
391 views

Restricting just a section of the page from editing

On one of my templates I need to restrict the write/rename and deletion of a component that gets added by default on the items for a specific role to a placeholder only. I cannot restrict the user ...
6
votes
0answers
183 views

How to enable custom hashing algorithm on identity server?

I have sitecore 9.1 and I added pipeline which add new hashing algorithm (pbkdf2 implementation from Zetetic team with 5000 iterations) to CryptoConfig and changed hashAlgorithmType to pbkdf2 in ...
5
votes
1answer
4k views

the selected version will not be visible on the Web site because it has been replaced by an older version

We have a 2 step workflow i.e draft and final. We notice the warning message below on any item when trying to edit If you publish now, the selected version will not be visible on the Web site ...