116
votes
Accepted
Is there a way to reset Sitecore admin password from database level?
The accepted answer is valid for previous version of Sitecore, but it does not reset the password salt and doesn't in fact reset the password to 'b'. In order to do this, you need the following ...
- 2,479
61
votes
Is there a way to reset Sitecore admin password from database level?
Yes there is.
Switch to your core database and execute the SQL below to reset the password to b:
UPDATE [aspnet_Membership] SET Password='qOvF8m8F2IcWMvfOBjJYHmfLABc='
WHERE UserId IN (SELECT ...
- 25k
32
votes
Accepted
How do I disable /sitecore access on a Content Delivery Server?
There are several pieces of documentation that are available for this:
First is https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening
This contains a ...
- 14.6k
29
votes
How do I disable /sitecore access on a Content Delivery Server?
While the above answers are correct; you should concern yourself with more than just restricting access to the /sitecore folder - there is a very quick and easy way to achieve what you are ...
- 25k
28
votes
Accepted
How to unlock the Sitecore admin user account?
If you have direct access to the database, you can run the following from SQL Management Studio:
UPDATE aspnet_Membership
SET IsLockedOut = 0,
FailedPasswordAttemptCount = 0
WHERE ...
- 2,536
26
votes
Is there a way to reset Sitecore admin password from database level?
Unlock_Admin doesn't work when you will decide to change your password encryption from SHA1 into SHA512 (regarding to Sitecore recommendations).
It does NOT reset password for Sitecore admin - it just ...
23
votes
Accepted
Sitecore Trivia - Anyone know the story behind admin / b username/password?
It was I that changed the default password to 'b', but it wasn't the result of a great meaningful insight, clever security considerations or a joke.
Truth is I was implementing the Change Password ...
- 356
20
votes
How to create multiple Sitecore Security Domain
Editing the domains through the Domain Manager tool will cause \App_Config\Security\Domains.config to be updated with the added details. If you are updating this tool then make sure you include this ...
- 13.8k
20
votes
Accepted
Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)
The issue here turned out to be the Sitecore.Services.SecurityPolicy setting.
By default it only allows local requests to the API and as I have more servers in the mix and a load balancer on Staging ...
- 9,306
17
votes
How to unlock the Sitecore admin user account?
In addition to the answer above, if you have the misery of forgetting the Sitecore password then this will save you:
UPDATE [aspnet_Membership] SET [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=',
[...
- 2,642
17
votes
Accepted
Does Sitecore support SAML?
This will be natively supported in Sitecore 9.0, according to the public roadmaps. For now a solution might be to use this module: https://github.com/BasLijten/SitecoreFederatedLogin
See my blog on ...
- 1,857
16
votes
WAF support with Sitecore Experience Platform
Update: Currently WAF is supported in diagnostic mode only for v8.2 and 9.0
In version 9.1 WAF is supported for the CD servers.
More information can be found here: https://doc.sitecore.com/...
- 5,653
14
votes
How do I disable /sitecore access on a Content Delivery Server?
We do this using an IIS Rewrite Rule like so:
<rule name="Block Sitecore Access Rule" stopProcessing="true" xdt:Transform="Insert">
<match url=".*" />
<conditions>
&...
- 9,306
14
votes
X-Frame Option in Sitecore 9
Yes, this is one of the recommended approaches to prevent clickjacking, and adding the X-frame-options header is one of the required steps.
After making the changes to the web.config, you should see ...
- 13.8k
13
votes
How to check access permissions on items for a user via the Security API?
The code you have posted will always return true by the nature of how Sitecore security works. If SelectItems() returns an item, that means the Sitecore.Context.User can read it. If the current user ...
- 20k
13
votes
Accepted
How do you best manage security domains using SXA with the Active Directory module?
After a nice weekend of trial-and-error with the help of DotPeek, here is what I've come up with. This should be a complete example for use after installing the Active Directory module (using version ...
- 18k
12
votes
Accepted
Technical vulnerability details on Sitecore critical vulnerability (SC2016-001-128003)
Update: I have removed technical details about the vulnerability, since it is still present on many Sitecore installations world-wide.
The Quick-and-Dirty fix
If you want to remove the vulnerability ...
- 12.6k
12
votes
Does Sitecore support SAML?
It might. There is a company claiming to have an option for it, but there is no direct download link and no way to easily verify the claim.
https://www.ssoeasy.com/sitecore-sso/
That said; you might ...
- 25k
11
votes
How to unlock the Sitecore admin user account?
There is also an admin page:
URL: http://www.yoursite.com/sitecore/admin/unlock_admin.aspx
By default, it's disabled so you need to edit the aspx file to set enableUnlockButton to true.
- 1,697
11
votes
Accepted
How do you setup your local Sitecore instance to support HTTPS in either a single or multi-tenant configuration?
This is not a solution I recommend for a production server, but if you need a certificate for a development server, I have a solution for you.
I use use a PowerShell script to create a certificate, ...
- 1,047
11
votes
Why does Sitecore insist on generating a new password to provide the 'old' password, when setting a new password
If you are using Sitecore 8.1 Update-2 or newer then there is a new Security Tools admin page that can be found at /sitecore/admin/SecurityTools.aspx.
The Reset User Password wil allow you to reset a ...
- 13.8k
11
votes
Accepted
How to create multiple Sitecore Security Domain
You can use the Domain Manager within Sitecore to create new security domains. From the Sitecore Desktop:
Start > Security Tools > Domain Manager
From there, you can setup your Sitecore Roles ...
- 1,851
11
votes
Accepted
the selected version will not be visible on the Web site because it has been replaced by an older version
Check if Version 2 of your item in "final" workflow state.
This is not an error. This is a functionality of Sitecore. When the current item version you are working on does not satisfy the requirement ...
- 3,777
10
votes
Accepted
Locking down Sitecore rendering caching
You can remove access to /sitecore/templates/System/Layout/Rendering Parameters/Standard Rendering Parameters/Caching
Navigate to the item
Open Security tab
Click on Assign button
In the dialog which ...
- 2,681
10
votes
Accepted
How do I set password complexity?
You can set this in the web.config. In your membership section. You can set a password strength regular expression.
<add name="sql" type="System.Web.Security.SqlMembershipProvider"
...
- 20k
10
votes
Accepted
MediaRequestProtection: An invalid/missing hash value was encountered
It usually means that a Url for a media asset is missing the Hash query string parameter when being called.
This was introduced in v7.5. It attempts to fix an image resize vunerability where you ...
- 20k
10
votes
Accepted
How to prevent a cookie replay attack?
It seems I was very close with overriding Sitecore's FormsAuthenticationProvider. With our first attempt we could successfully prevent cookie replay attacks, but we were unable to access the Sitecore ...
- 1,703
10
votes
Accepted
Update user password programmatically
As you can't get the old password, you should use the reset functionality:
var user = System.Web.Security.Membership.GetUser(@"domain\username");
var oldPassword = user.ResetPassword();
var ...
- 20k
10
votes
Accepted
How should security be handled for XM Cloud/Headless with Experience Edge?
The statement in the Sitecore documentation is somewhat misleading. Publishing your content to Experience Edge does NOT expose that content to the public. The Experience Edge endpoint requires an API ...
- 20k
9
votes
MediaRequestProtection: An invalid/missing hash value was encountered
Yes. Likely your solution is not generating protected Media Urls. Used to be:
var mediaUrl = Sitecore.Resources.Media.MediaManager.GetMediaUrl(mediaItem)
Was enough. But to protect against XSS ...
- 25k
Only top scored, non community-wiki answers of a minimum length are eligible