SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, so I finished developing my internet site. It uses a federation provider to authenticate public user. Now what I'm concern of, is the site security. I see that any logged in user can see the _layouts/viewlsts.aspx page. Even more, they can see data in the lists, and I don't want that to happen.

I searched a lot and find out that users can see even more page I was not aware of. For example http://site.url/_vti_bin/spdisco.aspx They can see some webservice sharepoint expose ect

Is there any article with best practices to make my site secure?

share|improve this question
Interesting one, you can lock this down for anonymous users but for authenticated users this is more difficult – Thomas Vochten Mar 5 '13 at 9:27
Yes I read about lock down feature, but the problem is there for authenticated users and they can see everything there :( – MIlena Mar 5 '13 at 9:59
up vote 1 down vote accepted

Waldek is right, you should definitively look into Liam in depth serie. In the meantime, nothing prevent you from implementing an http module like described over there :

If you're not able to make distinction from all your authenticated users (eg: public and internal collaborators that will contribute on that site), you should work with extended web applications (or a separate authoring and production environment). The extended application (or isolated environment) will be the only one to receive all your security trimming or custom module like the one suggested.

Keep in mind that an http module will run for all requests so you definitively want to optimize any procedures over there.

share|improve this answer

Liam Cleary (SharePoint MVP) wrote a series of articles on this topic recently. Check out the Security section on his blog for more details:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.