security on DevNet

Media library security settings working on QA but not Production

Lauren Groh — Dec 27, 2022 — Question

Intended functionality: Secured PDFs should only be accessible by users with privilege level set to @none@ and role set to @member@ (as well as by users with privilege level set to @Global Administ...

Control access to areas of MVC site with roles

Rod Carter — Sep 22, 2022 — Question

access mvc authentication security

I have a request from my business unit to control access to various areas of my MVC site (Version 11.0.26). We are aware of standard user login tracking within the .Net framework but are wondering...

Strange Security Behaviour

Matthew Butler — Aug 2, 2022 — Question

kentico 13 security

The security appears to work for the .net authentication, but when I start a new session that’s already logged in the Kentico check appear to fail on first try, then succeed.e.g. LoginClose browser...

Document roles

Tony Perry — Jan 17, 2022 — Question

kentico12 portal engine roles security

Hi,I'm looking for a way to get a list of roles that are assigned to a page that my widget is on. BackgroundI have a widget that in one config is performing some filtering of other documents, in ...

security question - Internal communication between website and admin

Ivan Louw — Nov 15, 2021 — Question

security

Hi Guys,I have just been asked what kind of security does kentico have when communicating between the database and website and website and admin. How does it handle sercurity.The site is bound to a...

Strange screen lock behaviour after upgrade to K13

J P — Jul 26, 2021 — Question

cms website security

I wonder if anyone else has run into this problem. After upgrade the CMS screen lock works as normal if the lock time is set to about 10 minutes.However if screen lock is set to 20 minutes (what it...

Find Page Security Roles via the API (or other means)

Steven Logan — Mar 19, 2021 — Question

api page roles security

I am trying to figure out how to get all the roles assigned to a page via the security (permissions) tab on the page. I do not see an API call that has that info.Here is the specific use case:We us...

How to secure a folder containing HTML5 videos by Kentico Role

Gregg Duncan — Dec 9, 2020 — Question

html5 videos security

Here's the scenario: We have many HTML5 videos (each video is a folder containing and HTML page and all the assets in subfolders to run an interactive video). I need to create a page with a repeate...

Setting the SameSite header for Kentico cookies

Zoltán Jalsovszky — Feb 22, 2020 — Knowledge Base Article

cookies csrf security header samesite

SameSite is an HTTP cookie header that provides a certain level of protection against Cross-site request forgery (CSRF) attacks by limiting where and how the cookies can be used. This article describes two methods of setting this header in Kentico.

Cleartext password vulnerability

Naresh Ede — Feb 13, 2020 — Question

password security vulnerabilities

Hi all,We have the below issue reported from our security team.When we enter the username @ password in CMS admin login form and submit, a POST request is sending to the CMSpages/Login.aspx page an...