Glass v5 properties intermittently null when security applied

Glass Mapper version 5 caches data more aggressively which is beneficial most of the time as it improves site performance. More information on the new caching features can be found here. In order to speed up performance some checks which Sitecore normally does are not performed when an item is returned from the cache. Usually this will not cause any issues but there could be potentially serious issues when security is involved. For example consider below scenario:

  1. User 1 has access to a certain item, but User 2 does not. Security is applied through the regular Sitecore security mechanisms.
  2. User 2 visits the site first, and Glass loads the model. This model has a link to the item which user 2 does not have access to, therefore this link is empty. It will get cached this way.
  3. Now user 1 comes and the model will be returned from cache. Since it was initially cached for user 2 the link is still empty whereas user 1 should be able to view this.

Notice that this behavior is not deterministic, i.e. if user 1 would have hit the site first then the item would be loaded. It would also be loaded for user 2 if that user visits later. This can cause intermittent and hard to find issues especially if the code was working correctly prior to upgrading. Good news is that fixing this is straightforward!


It is recommended to leave the cache on as much as possible to take advantage of the performance improvements.

Is there is an issue with a certain link which can point to an item where security might be applied, then caching can be turned off through an attribute like this:

[SitecoreType(Cache = Glass.Mapper.Configuration.Cache.Disabled)]
public virtual Link SecureLink { get; set; }

Perhaps this issue only occurs when retrieving items through the SitecoreService or MvcContext. In these cases the cache can be turned off explicitly in the call like this:

T val = mvcContext.GetDataSourceItem<T>(x => x.CacheDisabled())

GlassMapper GetRenderingParameters returning null after upgrade

If you have recently upgraded GlassMapper you might run into an issue where GetRenderingParameters returns null. I believe this started occuring in version or I was only experiencing this in WebForms. The issue occurs when you call GetRenderingParameters as described in this article (section “ASP .NET Webforms”).

The good news is that this issue has already been reported so hopefully it will be fixed in the next release. If you really need to upgrade to a version with this issue then you can easily fix this by downloading the code from github here and compiling Glass.Mapper.Sc DLL yourself.

The only code change that is required is to change

var sublayout = _control as Sublayout;

to remove underscore in control to reference the method parameter

var sublayout = control as Sublayout;

On line 40 of GetRenderingParametersInternal in Glass.Mapper.Sc.Web.Ui.GetRenderingParametersInternal see file in Github here