The web.config in Sitecore 9+ CM and CD Isn't The Same? Wait, WHAT?!?

So yeah, I had an education over the weekend. I figured the web.configs for xConnect sites were different, but I've always assumed it's the same for a CM and CD site. And I think in Sitecore 8 and lower, it might have been. But something changed on the way to Sitecore 9 that I'd never noticed, and I'm not just talking about the roles to define a CM and CD here.

Full credit here to Vincenzo Lui and Anders Laub on Sitecore Slack for this knowledge.

So I downloaded the XP1 packages for 9.3, broke them open, and pulled out the out of the box web.configs for both, then fired up my trusty WinMerge. Not that I doubted them, but they were right! Good news is, the changes aren't huge, but they should be accounted for certainly.

So excepting out the role difference, which is obvious, here's some screenshots of what to look for. The CM configuration is on the left, and the CD configuration is on the right.

This is also odd because the CM web.config duplicates these three settings. Lingering bugaboo I guess...

In the CD setup, we're allowing access specifically to these paths. You'll see why in a minute.

In this `MediaRequestSessionModule` call, the CM uses "Sitecore.Analytics.Media.MediaRequestSessionModule, Sitecore.Analytics" while the CD uses Sitecore.Analytics.RobotDetection.Media.MediaRequestSessionModule, Sitecore.Analytics.RobotDetection". Use the "name" value to key any transform, it's the same in both (MediaRequestSessionModule).

With the Telerik keys gone, this makes sense, and Telerik is really only used in the authoring environment anyway.

This URL rewrite section only exists on the CM.

On the CM, anonymous users can't access the "/sitecore/shell" and "/sitecore/admin" areas. On the CD, no one can access anything under "/sitecore" with the exceptions being the earlier defined items.

These three location areas only exist on the CM.

Only on CD is there a further definition of the authentication node.

So there you have it. I'd recommend doing this comparison on whatever version of Sitecore you're on, at least starting from 9.0. Your best bet would be to set up a CI/CD process where the base web.configs are never touched by developers, and you're just using transforms to do the work.

But that's another blog...stay tuned!