Views:

Applies to Product - Power Pages


What’s happening?
Customers are unable to restrict access to specific account registration pages in Power Pages, allowing unauthorized users to access these pages directly via URL.


Reason:
The default account registration page is accessible through direct URL input, which bypasses existing restrictions set for user registration.


Resolution:

  1. Set the site setting Authentication/Registration/OpenRegistrationEnabled to false to prevent the display of the account registration form at /Account/#####/Register.
  2. Navigate to the left navigation menu and select Site Settings.
  3. Open the record for Authentication/Registration/OpenRegistrationEnabled.
  4. Change the Value to false and save the record.
  5. To block access to other pages such as /Account/Manage/ChangeEmail and /Account/Manage/Change#####, enable the Web Application Firewall (WAF) and create rules to block access:
  6. Access the WAF settings as per the guidelines provided in the documentation.
  7. Create a new rule with the following settings:
    • Rule Type: Request
    • Request URL: Specify the part of the URL you want to block (e.g., /Account/Manage/ChangeEmail).
    • Traffic Setting: Block
  8. Save the rule and wait a few minutes for the settings to take effect.
For further details, refer to the Microsoft documentation on configuring WAF and setting authentication identity.