Always enforcing your sites single language in Sitecore

PROBLEM BACKGROUND

Do you have a sitecore website that will exist in only one language?

Have you checked what will happen if someone accesses your site passing the query string parameter sc_lang where sc_lang is set to a value your site doesn't support?  

Your site might throw a 500 error, it could redirect the user to your custom error page or it could throw a yellow screen of death.

Try your site out, see what happens.      You might be wondering why would this ever happen?

I became aware of this issue when one of our designers tried to pass an unsupported language to the sc_lang parameter to see what would happen.   Our site redirected the user to our error page, showing no content.

We all know malicious users exist.  If they find you are running a Sitecore instance, they can try to pass query string parameters to your site to see what happens.

If they get the ysod they might get useful information.


POTENTIAL RESOLUTION

Keep in mind, Sitecore is working as designed.  Sitecore can't find an item in the current language so it handles this situation based on how you have configured and coded Sitecore.

For our instance, we are only supporting one language.

So I overrode Sitecore's default LanguageResolver and replaced it with my own LanguageResolver.

Below is the code.   In the web.config or your custom .config file replace Sitecores Language resolver with your custom language resolver and you will be good to go.

       

    public class CustomLanguageResolver : LanguageResolver
    {
        private static Language _defaultLanguage;
        private static object lockObject = new object();

        private static Language DefaultLanguage
        {
            get
            {
                lock (lockObject)
                {
                    if (_defaultLanguage == null)
                    {
                        Language.TryParse("en", out _defaultLanguage);
                    }
                }
                return _defaultLanguage;
            }
        }

        public override void Process(HttpRequestArgs args)
        {
            try
            {
                base.Process(args);

                if (Sitecore.Context.Language.Name != "en" && DefaultLanguage != null)
                {
                    Sitecore.Context.Language = DefaultLanguage;
                }
            }
            catch (System.Exception e)
            {
                Logger.AddException(e, true);
            }
        }
    }
}