A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
1
vote
0answers
331 views

Sitecore 8 ADFS module no FedAuth cookie

I've added the Sitecore ADFS module to Sitecore 7.2 and it works. Using the same module on Sitecore 8 doesn't work. I can see the MSISAuth cookies from sts. When it comes to reading the FedAuth ...
1
vote
1answer
119 views

Using SecurityDisabler with Glass Mapper GlassView

We have content that we want to display that is in an area of the site secured from anonymous access. The idea is to show a group of pictures with a link to the content, and if you click it and aren't ...
5
votes
1answer
394 views

TDS authentication issue with Windows authentication

We have Windows authentication "wrapping" our Sitecore site to prevent access to a development server. We have Visual Studio and TDS installed on this server for pushing changes. After I set up ...
5
votes
3answers
1k views

Sitecore admin pages non-admin access

Is there a way to give access to a users to the /sitecore/admin/* pages without giving them access to the admin role?
2
votes
2answers
2k views

Media library access settings

I need to apply security setting to a folder in media library. This role should not be able to access any other folder than the assigned one. But the user is a member of another role which has full ...
3
votes
2answers
486 views

Best practice for Content Delivery in relation to databases

In a client's environment, a user login in will be added a role in order to have access to secured content. This mean that during the login operation, the user itself will be modified and saved. ...
3
votes
2answers
1k views

Sitecore virtual user vs Session

We are using Sitecore 8.1 to develop an Enterprise-level Website, this site receives around 1/2 million users. We have a user dashboard and other details that the visitor can see after login, and ...
7
votes
1answer
628 views

Sitecore Powershell Extensions - Reports Authorization

I've created some PSE scripts to give our client some reports on their content. I created them under the proper convention of Script Module and Script Library so that the reports show up under ...
4
votes
1answer
2k views

How to use the AntiForgeryToken with a custom log-in form? [closed]

There may be several forms on any given page of our site. Distinguishing between post requests from these forms is implemented using ValidateRenderingToken. There is also AntiForgeryToken / validation ...
1
vote
3answers
544 views

How to allow a user to publish items one by one, but not the entire site

I received a client request where they want me to modify the Author role; so that any user with this role can view and modify a subset of items, and can publish only a single item at a time and not ...
2
votes
1answer
316 views

How to secure MongoDB replica set environment?

Currently, I have 3 servers running MongoDB 3.0 as part of a Replica Set, and no security is applied. To connect I simple use mongodb://m01,m02,m03/analytics?replicaSet=rs0 Is it possible create ...
2
votes
1answer
452 views

Increasing SOLR security (hardening), and how Sitecore will handle with it?

I'm looking to increase the security of my SOLR environment and wonder how Sitecore will handle with it? For example, I saw a possibility to use SSL and I guess it would be simply replace HTTP to ...
9
votes
1answer
156 views

Do we have any security risk for exposing page Item GUID?

We have number of article pages in our site. I am trying to create article RSS feed specifically for Facebook Instant Articles consumption. As per their documentation, each item in feed should have ...
2
votes
1answer
752 views

Language based roles

We need to grant access to languages based on role (ex. the role for English and Spanish language) so that user with these roles will have access to specific languages.
5
votes
1answer
201 views

Read only CD server web DB connection string

A coworker of mine just asked me if we should make the connection string read only to the web database, on the CD server. I have never seen it done before when hardening the CD servers, but its an ...
5
votes
1answer
189 views

Could it possible to find out who changed sitecore password through sitecore logs or db?

Is it possible find out who changed sitecore password through sitecore logs or db ?
5
votes
1answer
4k views

the selected version will not be visible on the Web site because it has been replaced by an older version

We have a 2 step workflow i.e draft and final. We notice the warning message below on any item when trying to edit If you publish now, the selected version will not be visible on the Web site ...
3
votes
1answer
300 views

Using Sitecore authentication on external folders in IIS

We're using Sitecore authentication with a custom membership/roles database that's hooked into Sitecore with its own domain. We imported a ton of legacy data, and due to the number of documents, we ...
4
votes
2answers
703 views

Restricting access for Sitecore Administrator

We are having one problem to hide access to Template Manager, security editor and access Viewer option for a user with sitecore Administrator Role. To do this we denied read access for only select ...
7
votes
1answer
761 views

AntiForgery Tokens and Sitecore Development

I have set up some Sitecore extranet users (8.1.160519). I am using MVC AntiForgeryTokens for some posts. The problem is with the login form explicitly. When I am developing I am logged in as Admin ...
6
votes
1answer
502 views

Sitecore Logs shows The current user cannot be resolved from the authentication cookie

Sitecore logs are showing lot of these messages: WARN The current user cannot be resolved from the authentication cookie. The cookie will be removed. Ex: Line 556: 1820 07:14:48 WARN The ...
17
votes
3answers
3k views

Does Sitecore support SAML?

I'm aware of and have successfully used the AD module for numerous Sitecore implementations but I have a requirement to support SAML so that a non-AD based authentication provider can be used. Does ...
7
votes
1answer
158 views

Do I need to apply SC2016-001-128003 to 8.2 Update-1?

The article says only Initial Release of 8.2 is affected but doesn't say Update 1 is not vulnerable.
3
votes
1answer
320 views

No returnUrl property for secured media links

I've got authentication set up on certain pages of my website, with anonymous access denied. For regular items/pages, this works like regular forms authentication as you'd expect - click a link or go ...
4
votes
2answers
782 views

How to create multiple Sitecore Security Domain

We want to create multiple Sitecore security domains for different groups and their users. Can you advice as how to achieve this?
7
votes
1answer
372 views

How to best use Roles and Domains with Multi-site SSO

Background We have an upcoming multi-site project, in which our client would like us to implement a "restricted" SSO wherein the users of mainsite.com that have been given access to employees....
2
votes
1answer
59 views

workflowState.Security.GetAccessRules() returns a Security Role that shouldn't exist

I have code that gets the AccessRules for a workflow state. My local dev environment has a role called "sitecore\ABC Admin" this role only exists on my local environment. We have our workflow items in ...
4
votes
1answer
313 views

Determine Access rights for a role

I'm having trouble finding a good way to determine the Access Rights for a given role. Is there a easy way to get a list of items, that a given role have been granted access to, without iterating the ...
2
votes
1answer
452 views

Security setup - member of two roles with different access

I have an extranet where, by default, I've denied permissions to the whole tree to the anonymous account to ensure a login. One of the subitems is content only for staff who have access, rather than ...
1
vote
3answers
2k views

default admin user not working [closed]

I have problems with login using the default admin user. it wont let me login using /sitecore/admin/login.aspx If I login to the launchpad, I just get this It worked as expected after the clean ...
1
vote
2answers
88 views

protected languages -> Redirection

I have requirement i.e. I have some protected languages like de-DE (German), when user browsing these language ex: http://www.xyz.com/de-DE then he must redirect to login page. Could you please let ...
3
votes
3answers
1k views

Get user by custom property

I am working on forgot password functionality. I send email with link which contain special token to user to change password. This token is stored in Sitecore.Security.Accounts.User like custom ...
7
votes
2answers
2k views

Update user password programmatically

I am working on forgot password functionality. I use default sitecore user provider. How I can update user password programmatically? Is it possible to change password by manipulation with object of ...
2
votes
1answer
1k views

Error executing child request during redirect

I am trying to complete login redirect functionality. I prohibited read/write access for default/anonymous for mysite.org/security-page and added NoAccessUrl <setting name="NoAccessUrl" value="/...
3
votes
1answer
106 views

Any known way to hide Sitecore sensitive data

We have configured Sitecore security on items for the roles and seeing the sensitive data in the browser logs. We have a custom error page which interrogates the return codes(403/404/ or any other) ...
2
votes
1answer
1k views

Sitecore Anti Csrf Cookie

We are using Web forms and would like to know if we could reuse/enable Sitecore's built in Anti CSRF token mechanism for the website instead of limiting it's scope to Sitecore itself.. I couldn't ...
5
votes
1answer
755 views

How to return 401 page instead of login page when logged in user doesn't have permission

Currently, when a logged in user tries to access a page that they do not have permission to (because they don't have a certain role), Sitecore seems to redirect the user to the login page. This is ...
4
votes
1answer
740 views

How does one get the keepalive.aspx to work over SSL?

Is there a way to get Sitecore to accept the SSL cert or are we required to disable HTTPS on those directories? ManagedPoolThread #14 12:46:43 ERROR Exception in UrlAgent (url: /sitecore/service/...
4
votes
2answers
335 views

Remove the ability of a role to modify publish targets

How can I disable/hide the "Targets" tab of the publishing restrictions dialog for a given role? My role inherits from sitecore\Sitecore Client Publishing and I found that I can disable publishing ...
11
votes
1answer
266 views

AD Module over SSL

According to https://kb.sitecore.net/articles/886061 the AD module does not fully support SSL: The SitecoreADMembershipProvider provider supports SSL connection. This provider is based on System.Web....
5
votes
2answers
270 views

CD security hardening patch/transform

We are hosting our sites in azure web apps and in process of applying security hardening. Wondering if anyone has already written a patch/transform file for below: 1. Deny anonymous users access to ...
11
votes
1answer
982 views

How do you best manage security domains using SXA with the Active Directory module?

SXA provides the ability to create new tenants on-the-fly. Ideally each tenant would have a unique set of roles such as tenant1\admin and tenant1\editor. How do you configure roles and domains in ...
8
votes
4answers
637 views

Why does Sitecore insist on generating a new password to provide the 'old' password, when setting a new password

If I need to change a Sitecore user's password, the dialog requires that I submit the old password at the same time. Often I don't know the old password, so within the same dialog I can generate a new ...
9
votes
3answers
5k views

Best practices for HTTP Denial of Service configuration

A security audit has been performed for Sitecore setup. One of the issues revealed is about "HTTP Denial of Service" Description: A malicious user with a computer can send a specially crafted ...
5
votes
2answers
627 views

Securing a page with item permissions without redirecting the user away

Is it possible to set restrictive extranet group permissions on a page-level item, and still have that page render, albeit differently, to users without the correct permission i.e. present a call to ...
10
votes
1answer
187 views

After applying the Q3 2016 Security Update our sites went down

As you all might know Sitecore issued a critical security hotfix, after applying the fix to our client sites, most of them went down for on average 30 minutes before going back up again, and one of ...
14
votes
2answers
3k views

How to prevent a cookie replay attack?

As a result of a security audit, we must prevent an attacker from being able to do a cookie replay attack. Apparently this weakness has been around in the .NET framework for ages. There is also an old ...
4
votes
1answer
835 views

How to query Solr and only return content items that the current user has permissions to view?

I am building a Sitecore 8.1 / Solr 4.10 site. I want to be able to do a general site content query through the web database and only return content items that the current user has permissions to view....
7
votes
4answers
4k views

How to check access permissions on items for a user via the Security API?

I am trying to check Read permission for the current user on a specific item like the following: Sitecore.Data.Database.GetDatabase("master") .SelectItems("/sitecore/content/Settings/Item1")[0] ...
7
votes
1answer
622 views

Technical vulnerability details on Sitecore critical vulnerability (SC2016-001-128003) [closed]

What are the technical vulnerability which are covered by the critical vulnerability (SC2016-001-128003)? The KB article doesn't cover what the vulnerability is.