# Are there any best practices of protecting contents showing in site module

**URL:** <https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491>\
**Category:** Experience Manager (PaaS/OnPrem)\
**Created:** [October 14, 2018, 11:22am UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491 "2018-10-14T11:22:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonny](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@tonny](https://community.bloomreach.com/u/tonny)\
**Post date:** [October 14, 2018, 11:22am UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/1 "2018-10-14T11:22:40Z")

</div>

I faced a requirement that users should login before they can read some restrict contents. In the hippo’s document, there’s security of cms module, viz. restrict the user who can modify the contents. I tried to write the authentication and authorization in the `doBeforeRender` method of `org.onehippo.cms7.essentials.components.CommonComponent` class, but don’t know how I can get user login info in the method, and furthermore, is it the best practice for the case?

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [October 14, 2018, 12:01pm UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/2 "2018-10-14T12:01:08Z")

</div>

Do before render in hippo is not very different than doGet in servlet spec, so you can use same things (session etc). Easiest is to hook up spring security, we even have a plugin in for it, an in depth article can be found here:

> **[Setting up Spring Security in Hippo - Enterprise Java Content management system...](https://www.onehippo.org/labs/setting-up-spring-security-in-hippo.html)**
>
> Hippo Open Source Enterprise Content Management

---

<div class="post-metadata">

**Author:** ![tonny](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@tonny](https://community.bloomreach.com/u/tonny)\
**Post date:** [October 14, 2018, 12:28pm UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/3 "2018-10-14T12:28:55Z")

</div>

Thanks a lot for your kind info. And does the plugin use the users and groups stored in hippo repo? If i want to integrate with some external identity service, such as google api, does the plugin support it or I should add only spring security and then implement it by myself?

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [October 14, 2018, 1:56pm UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/4 "2018-10-14T13:56:44Z")

</div>

Both are possible, just use your own security provider instead of hippo one.

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [October 14, 2018, 2:00pm UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/5 "2018-10-14T14:00:25Z")

</div>

forgot to say: if you have a proxy in front of hippo application, you might need following plugin:

[https://onehippo-forge.github.io/servlet-filter-decorators/](https://onehippo-forge.github.io/servlet-filter-decorators/)

In many cases, Spring validates requested URL and fails to do so because it adds /site as a context to incoming URL. You can use above filter to return **/** instead of **/site** for example.

---

<div class="post-metadata">

**Author:** ![tonny](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@tonny](https://community.bloomreach.com/u/tonny)\
**Post date:** [October 15, 2018, 3:12am UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/6 "2018-10-15T03:12:37Z")

</div>

Thanks a lot. I’ll try these two plugins.

---

<div class="post-metadata">

**Author:** ![tonny](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@tonny](https://community.bloomreach.com/u/tonny)\
**Post date:** [October 22, 2018, 7:06am UTC](https://community.bloomreach.com/t/are-there-any-best-practices-of-protecting-contents-showing-in-site-module/491/7 "2018-10-22T07:06:07Z")

</div>

Hi machak,

Thanks a lot for your help and I can finally integrate the spring security with hippo, and it works perfectly. But there’s still one problem related to logout action behind a proxy. I set the logout action as follows:  
`<logout logout-success-url="/" logout-url="/logout" invalidate-session="true"/>`  
and in local dev environment, it links to `localhost:8080/site` as expected. However, if behind a proxy, it links to `domain.com/site` which does not exist, and a log message in site module shows the client tried to access `localhsot:8080/site/site/`. Could you have any idea of it please?