How do I get a link for a protected page and redirect the user to the login page? - authorization

In my Sitecore site I need a page viewable only to authorized users. I have allowed read and inheritance for the role I want and denied read and inheritance for extranet\anonymous. The item is part of a group where the other items are not protected. This list of items is databound and rendered as navigation links on the site.
var id = new Sitecore.Data.ID("<guid here>");
var item = Sitecore.Context.Database.GetItem(id);
// protected item is not part of Children collection when user is anon.
this.navrepeater.DataSource = item.Children;
this.navrepeater.DataBind();
When I'm logged in, a link to the protected item is shown and I can view the page. When I'm not logged in (operating as extranet\anonymous), the link is not shown at all. When I go the url directly I get a 403 error. In my web.config I have set the loginPage attribute on the site node but I don't get redirected.
<site name="mysite" ... loginpage="/login.aspx" />
So,
How do I display the link to the protected page for anonymous users
How do get sitecore to redirect the user to the login page when needed

1) You can wrap the code that retrieves the items for the nav links in the SecurityDisabler to show the link even if they can't view the page:
using(new SecurityDisabler()) { // this bypasses any security
this.navrepeater.DataSource = item.GetChildren(); // note that the Children property is deprecated, use the GetChildren() method instead
}
2) If you make your page's code behind class inherit from Sitecore.Shell.Web.UI.SecurePage it will handle the check and redirect to the login page for you. No coding needed.

Related

How to RedirectToPage to ChangePassword in razor pages identity

I can't use RedirectToPage for any of the pages in the identity folder in my razor pages app.
If I use: return RedirectToPage("/Identity/Account/Manage/ChangePassword");
What I got is an error:
InvalidOperationException: No page named '/Identity/Account/Manage/ChangePassword' matches the supplied values.
In the case of using Redirect itself, routing works fine but I need to route some values so I have to use RedirectToPage
If you want to use RedirectToPage, try the below code:
return RedirectToPage("/Account/Manage/ChangePassword");
/Account/Manage/ChangePassword means that we are looking for the ChangePassword.cshtml file in the Manage folder in the Account folder of the Pages folder.
return RedirectToPage("/Privacy");
/Privacy means that we are looking for the Privacy.cshtml file in the Pages folder.
The RedirectToPage() method is referring to a Razor cshtml "page" rather than a html page in the browser. So it expects the parameter to refer to a cshtml page in your project.
update:
If you add in IndexModel class to call page in Indentity folder you can try :
public IActionResult OnGet()
{
return RedirectToPage("/Account/Manage/ChangePassword", new { area = "Identity" });
}

Login page rendering value even when the user in not logged in

I am working on an angular app and implementing registration and logging functionality in it using Firebase. Both functionalties are working fine.
Now the trouble that I am having is in onAuthStateChanged() function. What I want is once a user is logged in, he/she must be able to see a message saying that they are logged in. I am even able to see "Hi {{currentUser.firstname}}" that I have mentioned in the code once I log in but as soon as I refresh the page and try to log in again, I see that "Hi {{currentUser.firstname}}" even when I do not click the login button. I don't know how my login page is rendering $rootScope.currentUser value even when I haven't logged in. I have written the following code for it
JS
auth.onAuthStateChanged(function(user) {
if (user) {
// User is signed in.
var data = firebase.database().ref('users/' + user.uid);
data.on('value', function(snapshot) {
var userobj=snapshot.val();
$rootScope.currentUser=userobj;
})} else {
// No user is signed in.
$rootScope.currentUser=' ';
}
});
html
<div class="userinfo" ng-show="currentUser">
<span class="userinfo">Hi {{currentUser.firstname}}</span>
</div>
The behaviour is by-design. From the docs:
The Firebase Auth instance persists the user's state, so that refreshing the page (in a browser) or restarting the application doesn't lose the user's information.
If you do not want the users's auth state to be persisted, you will need to sign out the user.

How to a hide a page

I have a pop up that is called through a java script, the same pop up without a JavaScript is an ctp page in cakephp. How can I hide that page from users and search engines going to access it like: /users/register
Is there anything that can be done in .htaccess or cakephp to prevent access to it through /users/register
Remove register.ctp file from users folder and create one in ajax folder users/ajax/register.ctp, then use RequestHandler component to inspect request type:
public function register()
{
if($this->request->is('ajax')){
// add registration code here
} else {
//Throw new error
}
}

single page application deep linking with login page

My team is going to build a single-page-application for our future project. At the moment, I have a problem with designing the app with login page. There are 2 approaches:
Create the login page as a separate page, the rest of the app is another single page.
The app has only 1 page and the login page will be a view in the app which is switched back and forth using javascript.
I don't know which approach I should take. I have read some discussions on the internet, it seems like it's more popular to create the login page as a separate page, the reason for this is we can use normal cookie-based authentication with session on server, redirect users to default page (main page) after successful login, and so on. Therefore, I'm thinking about creating the login page as a separate page, but I have a problem with deep linking.
For example, let's say I have 2 pages: login.html, index.html (main page). When an unauthenticated user requests a page like this index.html#product=1, the user will be redirected to the login.html, after successfully loging in, redirect the user back to index.html#product=1. But at this point, the #product=1 is lost.
Please advice me on how to keep the deep link or should I take the second approach?
Thank you
If you are building a single page app, it would be 'nicer' from the users point of view to have it all on one page, so I would suggest option 2.
Not sure if you need javascript to switch it though - you could use something like the following (PHP code)
At the start of the application saves what view the user is looking at and checks if the user pressed 'submit' on the login form
$selected_menu = $_GET['menu'] ;
//check to see if they've submitted the login form
if(isset($_POST['submit-login'])) {
If the login is successful, redirect them back to the same page with the appropriate view as a parameter
Then in the main page of the app when you are about to display data you would check to see if the user is validated, and if not then present the login form as part of the page.
$usr = CheckLogon();
if ( $usr == "" ) { // check for correct test to make sure user is logged on
ShowLoginForm();
....
I decided to go with approach 2: The app has only 1 page and the login page will be a view in the app which is switched back and forth using javascript.. I found out that it's not difficult to do and I can still use normal cookie-based authentication with session on server, redirect users to default page (main page) after successful login, and so on. Here is a sample code how I do it with angularjs.
Routing:
var App = angular.module('App', ["ui.state"]);
App.config(function ($stateProvider, $routeProvider) {
$stateProvider.
.state('login', {
url: "/login?returnUrl",
templateUrl: '/Home/Login',
controller:"LoginController"
})
.state('main', {
url: "/main",
abstract:true,
templateUrl: '/Home/Main',
controller: "MainController"
})
})
.run(function ($rootScope, $state, $stateParams, $location) {
$rootScope.$on('$stateChangeError', function(event, toState, toParams, fromState, fromParams, error){
if (error.status == 401) {
$state.transitionTo("login", { returnUrl: $location.url() });
}
})
});
The point here is when there is a route change error with status 401 (from the server) indicating that the user is not logged in, I will transition to login state with the return url.
After the user successfully logging in using ajax, I will transition the state back to my main view. Something like this:
$http.post("/Login", JSON.stringify({UserName:username,Password:password}))
.success(function (data, status, headers, config) {
var returnUrl = $stateParams.returnUrl ? $stateParams.returnUrl : "mydefaulturl";
$location.url(returnUrl);
})
With this approach, now I'm able to create deep-link to jump to a specific state in my app with login page and return url.

CakePHP - loginRedirect - How to redirect to the current page after login?

I have a login form that appears on all pages (Layout/default.ctp) and I want to keep the user on the page he logs in on. For example, if he is viewing another user's profile, I want to keep him there after logging in, not redirect him to the $this->Auth->loginRedirect action. Also, another thing about my app is that I have no "authenticated access only" pages, every page is accessible to everyone, but if you're logged in you get additional features.
How can I do that?
I solved this question, writing this code:
UsersController:
if($this->Auth->Login()){
$this->redirect($this->Auth->redirect());
}
In AppController:
public function beforeFilter(){
if($this->here != '/cmap/users/login'){
$this->Session->write('Auth.redirect', $this->here);
}
}
Have you tried $this->referer().
login function
function login()
{
if ($this->Auth->user())
{
$this->redirect($this->referer());
exit();
}
}