How prevent or restrict the usage of ?.do back door to backend

[AnttiP]

Does anyone know how we could either prevent or at least restrict the usage of "?.do" back door to backend?

As you well know, many customer wants to restrict the end users = roleless users of going to backend. As there are some OOTB ways to automatically redirect (roleless) users from backend (nav_to.do) to portal, they do not get triggered when ?.do is used. Neither I have found a way to prevent the usage of this method for named or even all users. Any thoughts on this?

What I have tried is: I created an UI page with name '?' and tried creating various ACL rules for it. No effect.

I also created a Support ticket for this.

[Mark Roethof]

Hi there,

You could have a look at the Public Pages [sys_public] and search for page you are after. Then deactivate that page.

If my answer helped you in any way, please then mark it as helpful.

Kind regards,
Mark
2020-2022 ServiceNow Community MVP
2020-2022 ServiceNow Developer MVP

---

LinkedIn
Community article, blog, video list

[AnttiP]

Hi Mark,

The problem is that there seems to be no page or any other record for "?.do" whatsoever.

BR,
AnttiP.

[mco]

Hi AnntiP,

Did you solved your issue ? we are facing to the same situation .

Thanks for your reply.

Kr,

Michaël

[AnttiP]

Nope. Opened a case for SN Support. According to SN there is no way to prevent this. What a shame.

[Philippe Casidy]

Hi,

Is that property you are looking for?

glide.entry.loggedin.page_ess

It is in a note in

Specify a login landing page (servicenow.com)

We are using it and regret it. It makes difficult to do testing from this kind of user perspective and deactivating it permanently in testing environment would make wrong testing.

Make sure UI Actions and pages have roles, there is an instance check suite that will do multiple testing:

/scan_check_suite.do%3Fsys_id%3D833655cc1b94101046e87733cd4bcb4e

Please let me know how it works for you anyway.

Philippe