Web.Helix.config to do Sitecore security hardening

richardszalay / helix-publishing-pipeline

Unified publishing for Sitecore Helix solutions that extends existing Visual Studio and command line workflows

MIT License

68 stars 18 forks source link

Web.Helix.config to do Sitecore security hardening #57

Closed kmac23va closed 5 years ago

kmac23va commented 5 years ago

I'm working off of Helixbase, which now includes this project. I set up a Web.Helix.config file to apply the handler transforms (like disabling the RSS feed) and for changing the security type to SHA512. When I publish, however, I get a Web.Helix.config file added to my web root, not transforms.

Do I need to apply a parameters.xml file and change the mapping to handle these cases? Is there something else that needs doing? Or does this trick only work with appSettings?

richardszalay commented 5 years ago

You should mark the Web.Helix.config file with a Build Action of None to prevent it from being published.

Is the Web.Helix.config file in the Website project or a module?
Are you publishing the Web.config in Website or are you skipping it?

kmac23va commented 5 years ago

I didn't have the web.config in Website marked as Content, but the Web.Helix.config (in one of the subprojects) was marked with a Build Action of None already. That did work after I marked the Website one as Content, so it was my error, but good to get a sanity check. Not sure why the Web.Helix.config got out there when marked None though. Thanks!