Just go to the root node in your content tree and remove the "Everyone" role.  It's this role that makes the pages publically accessible, once this role is removed, everyone must login.

It's worth adding a middleware to decorate all responses with a "noindex, nofollow" X-Robots-Tag header for the Integration and PreProduction environments, you can target this by injecting IWebHostEnvironment into such a middleware and adding the header to the response.

Hi Mark

Thanks for your suggestions. We are currently using the content tree permissions approach, but this causes us some complications with some functionality in our solution (Things like custom scheduled jobs that are unable to read pages for specific tasks). Also this approach means whenever we perform content roll downs from prod, we will need to re-apply the change. That's obviously a very minor problem to have but we were hoping there was a nice clean solution to this problem similar to the CMS 11 one.

Your additional suggestion for the x-robots-tag is something we hadn't thought of. Thanks for that, we're going to implement it.

I'll hold out in the hope there is a programmatical way to force users to the login page on DXP environments in the mean time.

Thanks again

Jimmy

Hello Jimmy,

You could again address this in middleware that operates conditionally on Integration and Preproduction that returns a 401 if the user is not logged in.  That way you don't have to adjust your content tree permissions or add Authorization attributes to all of your content.

Regards,
Mark

As Mark suggested, you can go for a custom middleware. You could also enforce IP network restrictions, instead of authentication. Cause if you enforce authentication, then it can be hard to test some unauthenticated scenarios before production.

Also ensure you don't block access to health check and warmup endpoints. They "prefer" response codes in the 200's. Otherwise deploying to Preproduction could take a very long time.

Hi Jimmy

You can give a try of this module if you don't want to roll out your own one

NuGet Gallery | IPWhitelist 1.0.0-beta.5

Thanks for all of your suggestions. We ended up going with the middleware approach.