How to secure the CM site in Sitecore? - sitecore

Question

I'm trying to lock down the CM (master) site. The users are going to have to login in order to view the site.
The config below gets added to sitecore.config. Unfortunately, the implementation below only works fro the homepage (e.g. /).
When an anonymous user goes to /hello-world, they'll see a "white" page that doesn't have any content. It doesn't direct them to the login page.
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
<sitecore>
<sites>
<site name="website"
set:requireLogin="true"
set:domain="sitecore"
set:loginPage="/sitecore/login"
set:targetHostName="master.website.com"
set:scheme="http" />
</sites>
</sitecore>
</configuration>
Visiting homepage takes me to
login page
But, if i manually enter an interior page URL, i get the following:
white page

Answer 1

To make it work, only 2 settings should be changed for the "website" configuration node - requireLogin and loginPage. So you definitely set it correctly.
I met similar "blank page" issue in the past, it was related to some misconfiguration of the ItemNotFoundUrl setting. It could be your case as well, if the "hello-world" page doesn't exist.

Answer 2

Can you please try this:
<site name="website" virtualFolder="/" physicalFolder="/" rootPath="/sitecore/content" startItem="/hello-world" database="master" domain="extranet" allowDebug="true" cacheHtml="true" htmlCacheSize="10MB" registryCacheSize="0" viewStateCacheSize="0" xslCacheSize="5MB" filteredItemsCacheSize="2MB" enablePreview="true" enableWebEdit="true" enableDebugger="true" disableClientData="false" requireLogin="true" loginPage="/sitecore/login/Default.aspx" />
Highlights:
startItem : set to hello-world page (assuming this is the home item)
database : set to master (depends on your test case(s), you can use web db, as well)
loginPage : redirect to Sitecore login page
requireLogin : enforce login, set to TRUE

Answer 3

After further investigation, and contacting the sitecore community, I found out that there is a bug in sitecore 8 update 5 (mvc). The security check doesn't work properly.
Here is the FIX:
1. Add a pipeline that inherits from SecurityCheck.
public class SecurityCheck : Sitecore.Pipelines.RenderLayout.SecurityCheck
{
private RequestBeginArgs originalArgs;
public virtual void Process(RequestBeginArgs args)
{
originalArgs = args;
Process(new RenderLayoutArgs((System.Web.UI.Page)new Sitecore.Web.UI.HtmlControls.Page(), (Item)null));
}
protected override bool HasAccess()
{
SiteContext site = Context.Site;
if (site != null && site.RequireLogin && (!Context.User.IsAuthenticated && !this.IsLoginPageRequest()))
{
originalArgs.AbortPipeline();
return false;
}
if (site == null || site.DisplayMode == DisplayMode.Normal || (Context.User.IsAuthenticated || !(PreviewManager.GetShellUser() == string.Empty)) || this.IsLoginPageRequest())
return true;
originalArgs.AbortPipeline();
return false;
}
}
2. Add this processor as a first processor in the
<mvc.requestBegin>
<!-- security check for site -->
<processor type="Namespace.SecurityCheck, Assembly"/>
</mvc.requestBegin>