Overwrite Default Pages
To replace the built-in login, password reset or security page, build a page on the same URL, save it and activate it. A page in an active blueprint always wins over the built-in one.
Claim the URL with your own page
Build the page
Add a
web_pageblock, or use an existingstate_page. Its URL (theevent) is the path you want to replace, such aslogin. See Your First Page.Keep your way back open
A broken login page could lock people out, so note the login escape hatch first:
?studio=1always reaches the built-in page.Save and activate
Once the page is saved in an active blueprint, the built-in page is replaced for all public users within your cluster. Repeat for any other page in the table below.
Three pages can be overwritten
| Page | What the built-in page does |
|---|---|
login | Gives users access when they try to reach restricted or authentication-required areas. |
passwordreset | Lets users reset their passwords. |
security | Lets users view and manage their active sessions and multi-factor authentication options. |
A custom login page leaves the security to you
When you develop your own login system, you are responsible for implementing comprehensive security measures. RUAL still helps in these ways:
- Always enforced: mass multi-authentication attempts from the same IP address are prevented, and repeated unsuccessful authentication attempts to the same user account are blocked.
- On a web page: values are escaped for where they stand in the template, and an action posted from another website is refused. See Security.
- On a state page: form hoisting and input sanitization are handled for you.
The sign-in flow behind the page, from emailing a code to starting a session, is built in Building a Login Page.
?studio=request to the URL to get the default login page back. Any non-empty value works, and the built-in page renders even when your custom page is broken, blank or deactivated. Login Escape Hatch covers this recovery path in full. Frequently asked
Which default RUAL pages can I overwrite?
The login, passwordreset and security pages. Build a page, with a web_page block for new work, on the URL of the page you want to replace, save and activate it, and from then on your page is served instead of the built-in one.
How do I get back in if an overwritten default page locks me out of RUAL?
Append ?studio=1 to the login URL to force the built-in login page, then fix or deactivate your page. A deactivated page no longer claims the URL.
What security does RUAL still enforce on a custom login page?
RUAL keeps preventing mass multi-authentication attempts from the same IP address and blocks repeated unsuccessful authentication attempts against the same user account, and the broader security of your login flow is your own responsibility. Form hoisting and input sanitization apply to state pages; web pages escape values by where they land and refuse actions from other sites.