How to secure pages

[piranhacms]

How to secure pages

[tidyui]

We will provide a tutorial for you

[tidyui]

Please take a look at this tutorial and let us know if it makes sense or should be improved in any way!

Source code:
https://github.com/PiranhaCMS/piranha.core.docs/blob/master/src/08.%20Tutorials/01.%20Securing%20Pages.md

Webpage:
http://piranhacms.org/docs/tutorials/securing-pages

Regards

[tidyui]

I think I missed out one thing for MVC. This baseclass when using Razor Pages catches the exception thrown by model loader and returns unauthorized:

https://github.com/PiranhaCMS/piranha.core/blob/master/core/Piranha.AspNetCore/Models/SinglePost.cs#L72

You need to add the same behavior by yourself in your controller actions in CmsController, otherwise you will just get an exception and not a 401.

Regards

[tidyui]

No. The minimum requirements for logging into the admin interface is that the user is an admin. It hasn’t been designed with that use case in mind.

[traustitj]

Thank you for the quick reply. Do you have any instructions on how to use the admin to go to authorized pages? Or how to do best practice of authorized pages?

[tidyui]

I think we will have to do a tutorial on it, but in short, here are my suggestions:

1. Add AuthorizeAttribute on manager pages.
2. Do not add AuthorizeAttribute on public pages, instead select the claims the user should have on the page instance.
3. For public pages, get them using the IModelLoader, like in the template projects. The loader will perform security checks for the current user and the requested page.
4. If the user doesn't have access, the IModelLoader will throw a UnathorizedException, customize the middleware pipeline to redirect users when this happen to a public login page, not the login page of the manager.

Best regards

[traustitj]

I don't understand you here

[tidyui]

I moved this issue to the docs repo as well

[traustitj]

Hi.
Thank you so much.
I made this repo, https://github.com/traustitj/piranhalogin.git

Not Sure what I am doing wrong here.

[traustitj]

Ahh, thank you. You really helped me a great deal.

[traustitj]

Works like a charm.