Password protect dev/staging sites only

Jay Heavner asked on June 29, 2022 15:24

Currently, my dev and staging sites sit behind my firewall but I have a need to allow access to third parties. There is embargoed content on these systems that can't display when viewing the presentation side of the site. I can certainly turn on password protection but that is a setting that can, and will, end up being synced through the staging module.

Is there a way to secure the presentation sites of non-production instances without no risk of that setting being synced?

security and membership

Recent Answers

Brenden Kehren answered on June 29, 2022 17:34

What version and development method are you using?

We just did this for a v13 .netcore 6 site and got it implemented pretty quickly.

0 votesVote for this answer Mark as a Correct answer

Jay Heavner answered on July 5, 2022 15:12

Sorry for the delay in responding. We have two sites, both are K12. One is MVC and the other webforms. Both some version of .Net framework (not Core).

How did you go about securing your instance?

0 votesVote for this answer Mark as a Correct answer

Brenden Kehren answered on July 5, 2022 16:50

For the Portal Engine one, it's pretty simple, go to the Pages application and at the root of the site, click on the General > Security tab and select the radio button to require authentication. This will force the whole site to require a login. You'll need to create user accounts to allow the users to log in.

For the MVC site, you start out similar in forcing the site to require authentication, however, you'll need to implement the login page and authentication within your MVC application. I'd suggest checking out the DancingGoat example site for this code.

0 votesVote for this answer Mark as a Correct answer

Jay Heavner answered on July 5, 2022 16:53

How do I prevent this change from syncing to my prod environment? That's my biggest concern. I need my prod environment to be public and only password protect dev/staging.

0 votesVote for this answer Mark as a Correct answer

Brenden Kehren answered on July 5, 2022 17:03

Tell users to not stage the "master page" to the prod site. Your code can remain in place without issue, just don't set the master page to require authentication.

0 votesVote for this answer Mark as a Correct answer

Brenden Kehren answered on July 9, 2022 06:06

Hey Jay,

Have a look at this blog post I just published. I've had this in the works for a bit but it should help you out. There's also a GitHub repo with it too.

0 votesVote for this answer Mark as a Correct answer