Secure UI and admin interfaces

Restrict access to the editing and administration interfaces to prevent unauthorized users from reaching sensitive CMS functionality. This step is especially important in decoupled setups where the public site and the CMS UI run on separate servers.

General considerations

Follow these guidelines for solutions with physically separated servers:

• Host the UI server on an internal protected network, separate from the public site.
• Remove access to editing and administration interfaces on the public-facing server.
• Remove custom edit and admin plug-ins from the public-facing server (for example, by deleting the files).
• When separate servers are not possible, configure separate IIS bindings for the public site and the UI. Use SSL on the UI binding.

Remove access to editing and administration interfaces

Block access to the edit and admin UIs on a public-facing server. Define the CmsPolicyNames.CmsEdit and CmsPolicyNames.CmsAdmin policies to deny all access. These policies are checked when edit or admin resources are requested.

var publicFront = _configuration.GetValue<bool ?> ("PublicFront");
if (publicFront.GetValueOrDefault(true)) {
  services.Configure<AuthorizationOptions>(o => o.AddPolicy(CmsPolicyNames.CmsAdmin, b => b.RequireAssertion(c => false)));
  services.Configure<AuthorizationOptions>(o => o.AddPolicy(CmsPolicyNames.CmsEdit, b => b.RequireAssertion(c => false)));
}

Secure the editing and administration interfaces

CMS supports relocating the edit and admin folders to custom folder names and configurable HTTP ports. This makes it harder for unauthorized users to discover sensitive resources.

Rename the UI path

1. Change UIOptions.EditUrl to a custom path:

   C#

   services.Configure<UIOptions>(o => o.EditUrl = new Uri("~/newuipath/CMS/", UriKind.Relative));

   To host the UI on a different port, use an absolute URL with a non-standard port:

   C#

   services.Configure<UIOptions>(o => o.EditUrl = new Uri("https://securehost:8888/newuipath/CMS/", UriKind.Absolute));

   Do not set EditUrl to a custom host and port in multi-site setups because each site has custom domains. Use a separate editing server instead and remove access to editing and administration interfaces on the public-facing server.

2. Change the RootPath for protected modules from ~/Optimizely/ to ~/newuipath/:

   C#

   services.Configure<ProtectedModuleOptions>(o => o.RootPath = "~/newuipath/");

Add support for SSL

Use SSL to encrypt traffic between the browser and the CMS UI. Configure SSL bindings in IIS or the hosting environment. This protects authentication credentials and session data in transit.