Attachment requiring login?

Aaron VanMeter asked on March 1, 2017 00:15

We're having a case where the getattachment link is requiring the user to be logged in before the image will be displayed, even though the site/folder/page the images are attached to are all set "No" on Requires Authentication.

For example hitting http://site/cms/getattachment/a1f4275e-102c-4ee9-93d9-b13de2095ab9/1-a.jpg.aspx will immediately redirect to the login page. Once logged in, it displays fine, but it will not display for a un-authenticated user.

I've tried turning on all debugs, but the getattachment page does not seem to get captured with the rest of the UI pages - the only log it shows up on is the "Event handlers" debug log with 6 events:

RequestEvents.Begin.Execute ApplicationModule.BeginRequest
RequestEvents.Authenticate.Execute ApplicationModule.AuthenticateRequest
RequestEvents.End.Execute ApplicationModule.EndRequest
>> SecurityEvents.AuthenticationRequested.Execute ApplicationModule.EndRequest
RequestEvents.RunEndRequestTasks.Execute ApplicationModule.EndRequest
RequestEvents.Finalize.Execute

The next event logged is the load of the login page.

Any ideas?

kentico 10 getattachment

Recent Answers

Trevor Fayas answered on March 1, 2017 01:40

What version and hotfix?

Are there any iis settings that require authentication for areas of the site?

0 votesVote for this answer Mark as a Correct answer

Aaron VanMeter answered on March 1, 2017 01:54

10.0.5, and no, we've not changed the authentication in IIS for any areas of the site.

0 votesVote for this answer Mark as a Correct answer

Peter Mogilnitski answered on March 1, 2017 02:28 (last edited on March 1, 2017 03:28)

An attachment is secured i.e. requires an authentication if a document is secured. If you go edit your page that has this attachment, switch to properties -> security: Make sure that requires authentication is 'NO'

Image Text

Is this document field attachment (grouped attachment) or unsorted attachment ( the one you set on properties -> attachments tab)?

Can you access your attachment via http://site/getattachment/a1f4275e-102c-4ee9-93d9-b13de2095ab9 ?

0 votesVote for this answer Mark as a Correct answer

Trevor Fayas answered on March 2, 2017 15:31

Found the issue.

The attachment link that is provided by clicking the link to the attachment through the attachments tab is NOT the correct url to use. That url requires login.

If you add the image to an editable text, it gives a different attachment url format that doesn't require auth.

/cms/getattachment/47f60573-166e-4b44-9983-2d9718fa45c1/half-placeholder.png.aspx?chset=68b9eddd-2998-4a09-b160-bfb31bc0fba1 <- This one requires login

/getattachment/Test-Page/half-placeholder.png.aspx?lang=en-US <- This doesn't

0 votesVote for this answer Mark as a Correct answer

Brian Bailey answered on June 20, 2017 22:46 (last edited on June 20, 2017 23:22)

We are running into a similar issue, but it is with an image field that we added to a page type. It doesn't seem like we can insert such images into content in order to get the other URL method for accessing the image. Any thoughts on how to obtain this information?

The solution that we ended up coming up with was using a text field and using image/media selector instead of having a file. That will lead to better site organization for us anyway and it created clear URL to the image within the library.

0 votesVote for this answer Mark as a Correct answer