112 votes
Accepted

Is there a way to reset Sitecore admin password from database level?

The accepted answer is valid for previous version of Sitecore, but it does not reset the password salt and doesn't in fact reset the password to 'b'. In order to do this, you need the following ...
user avatar
  • 2,439
61 votes

Is there a way to reset Sitecore admin password from database level?

Yes there is. Switch to your core database and execute the SQL below to reset the password to b: UPDATE [aspnet_Membership] SET Password='qOvF8m8F2IcWMvfOBjJYHmfLABc=' WHERE UserId IN (SELECT ...
user avatar
  • 24.3k
31 votes
Accepted

How do I disable /sitecore access on a Content Delivery Server?

There are several pieces of documentation that are available for this: First is https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening This contains a ...
user avatar
  • 14.3k
29 votes

How do I disable /sitecore access on a Content Delivery Server?

While the above answers are correct; you should concern yourself with more than just restricting access to the /sitecore folder - there is a very quick and easy way to achieve what you are ...
user avatar
  • 24.3k
28 votes
Accepted

How to unlock the Sitecore admin user account?

If you have direct access to the database, you can run the following from SQL Management Studio: UPDATE aspnet_Membership SET IsLockedOut = 0, FailedPasswordAttemptCount = 0 WHERE ...
user avatar
  • 2,526
26 votes

Is there a way to reset Sitecore admin password from database level?

Unlock_Admin doesn't work when you will decide to change your password encryption from SHA1 into SHA512 (regarding to Sitecore recommendations). It does NOT reset password for Sitecore admin - it just ...
user avatar
22 votes
Accepted

Sitecore Trivia - Anyone know the story behind admin / b username/password?

It was I that changed the default password to 'b', but it wasn't the result of a great meaningful insight, clever security considerations or a joke. Truth is I was implementing the Change Password ...
user avatar
  • 346
20 votes

How to create multiple Sitecore Security Domain

Editing the domains through the Domain Manager tool will cause \App_Config\Security\Domains.config to be updated with the added details. If you are updating this tool then make sure you include this ...
user avatar
  • 13.6k
20 votes
Accepted

Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)

The issue here turned out to be the Sitecore.Services.SecurityPolicy setting. By default it only allows local requests to the API and as I have more servers in the mix and a load balancer on Staging ...
user avatar
16 votes

How to unlock the Sitecore admin user account?

In addition to the answer above, if you have the misery of forgetting the Sitecore password then this will save you: UPDATE [aspnet_Membership] SET [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=', [...
user avatar
16 votes
Accepted

Does Sitecore support SAML?

This will be natively supported in Sitecore 9.0, according to the public roadmaps. For now a solution might be to use this module: https://github.com/BasLijten/SitecoreFederatedLogin See my blog on ...
user avatar
  • 1,847
16 votes

WAF support with Sitecore Experience Platform

Update: Currently WAF is supported in diagnostic mode only for v8.2 and 9.0 In version 9.1 WAF is supported for the CD servers. More information can be found here: https://doc.sitecore.com/...
user avatar
14 votes

How do I disable /sitecore access on a Content Delivery Server?

We do this using an IIS Rewrite Rule like so: <rule name="Block Sitecore Access Rule" stopProcessing="true" xdt:Transform="Insert"> <match url=".*" /> <conditions> &...
user avatar
14 votes

X-Frame Option in Sitecore 9

Yes, this is one of the recommended approaches to prevent clickjacking, and adding the X-frame-options header is one of the required steps. After making the changes to the web.config, you should see ...
user avatar
  • 13.6k
13 votes

How to check access permissions on items for a user via the Security API?

The code you have posted will always return true by the nature of how Sitecore security works. If SelectItems() returns an item, that means the Sitecore.Context.User can read it. If the current user ...
user avatar
  • 18.8k
13 votes
Accepted

How do you best manage security domains using SXA with the Active Directory module?

After a nice weekend of trial-and-error with the help of DotPeek, here is what I've come up with. This should be a complete example for use after installing the Active Directory module (using version ...
user avatar
  • 16.4k
12 votes
Accepted

Technical vulnerability details on Sitecore critical vulnerability (SC2016-001-128003)

Update: I have removed technical details about the vulnerability, since it is still present on many Sitecore installations world-wide. The Quick-and-Dirty fix If you want to remove the vulnerability ...
user avatar
11 votes

How to unlock the Sitecore admin user account?

There is also an admin page: URL: http://www.yoursite.com/sitecore/admin/unlock_admin.aspx By default, it's disabled so you need to edit the aspx file to set enableUnlockButton to true.
user avatar
  • 1,697
11 votes

Why does Sitecore insist on generating a new password to provide the 'old' password, when setting a new password

If you are using Sitecore 8.1 Update-2 or newer then there is a new Security Tools admin page that can be found at /sitecore/admin/SecurityTools.aspx. The Reset User Password wil allow you to reset a ...
user avatar
  • 13.6k
11 votes
Accepted

How to create multiple Sitecore Security Domain

You can use the Domain Manager within Sitecore to create new security domains. From the Sitecore Desktop: Start > Security Tools > Domain Manager From there, you can setup your Sitecore Roles ...
user avatar
11 votes

Does Sitecore support SAML?

It might. There is a company claiming to have an option for it, but there is no direct download link and no way to easily verify the claim. https://www.ssoeasy.com/sitecore-sso/ That said; you might ...
user avatar
  • 24.3k
11 votes
Accepted

the selected version will not be visible on the Web site because it has been replaced by an older version

Check if Version 2 of your item in "final" workflow state. This is not an error. This is a functionality of Sitecore. When the current item version you are working on does not satisfy the requirement ...
user avatar
  • 3,687
10 votes
Accepted

Locking down Sitecore rendering caching

You can remove access to /sitecore/templates/System/Layout/Rendering Parameters/Standard Rendering Parameters/Caching Navigate to the item Open Security tab Click on Assign button In the dialog which ...
user avatar
10 votes
Accepted

How do I set password complexity?

You can set this in the web.config. In your membership section. You can set a password strength regular expression. <add name="sql" type="System.Web.Security.SqlMembershipProvider" ...
user avatar
  • 18.8k
10 votes
Accepted

MediaRequestProtection: An invalid/missing hash value was encountered

It usually means that a Url for a media asset is missing the Hash query string parameter when being called. This was introduced in v7.5. It attempts to fix an image resize vunerability where you ...
user avatar
  • 18.8k
10 votes
Accepted

How do you setup your local Sitecore instance to support HTTPS in either a single or multi-tenant configuration?

This is not a solution I recommend for a production server, but if you need a certificate for a development server, I have a solution for you. I use use a PowerShell script to create a certificate, ...
user avatar
  • 1,037
10 votes
Accepted

How to prevent a cookie replay attack?

It seems I was very close with overriding Sitecore's FormsAuthenticationProvider. With our first attempt we could successfully prevent cookie replay attacks, but we were unable to access the Sitecore ...
user avatar
  • 1,693
10 votes
Accepted

Update user password programmatically

As you can't get the old password, you should use the reset functionality: var user = System.Web.Security.Membership.GetUser(@"domain\username"); var oldPassword = user.ResetPassword(); var ...
user avatar
  • 19.1k
9 votes

MediaRequestProtection: An invalid/missing hash value was encountered

Yes. Likely your solution is not generating protected Media Urls. Used to be: var mediaUrl = Sitecore.Resources.Media.MediaManager.GetMediaUrl(mediaItem) Was enough. But to protect against XSS ...
user avatar
  • 24.3k
9 votes
Accepted

Best practices for HTTP Denial of Service configuration

Slow HTTP attacks are denial-of-service (DoS) attacks that rely on the fact that the HTTP protocol, by design, requires a request to be completely received by the server before it is processed. If an ...
user avatar
  • 858

Only top scored, non community-wiki answers of a minimum length are eligible