Restricting access to anonymous web APIs

Question

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html
By default magento 2 only restrict Catalog, Store and CMS API from anonymous users.

In a same way how I can restrict access for all the available API's in magento 2?

The reason is I am building an Mobile app and website based on Angular and I wanted that only my app and website should have access to all the API.

Answer 1

To disable Anonymous Guest Access Go to

Admin > Menu > Store > Configration > Services > Magento Web API > Web API Security

Allow Anonymous Guest Access set to No

If you Set Allow Anonymous Guest Access set to No, Magento Website will not function properly as some API is used by Magento Checkout Process. You have to disable Guest Checkout.

Check http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html

Answer 2

I am currently on Magento 2.2 Commerce instance. We ran into similar issues when we found spammers were creating accounts by hitting the customer APIs. Magento support stated some APIs remain open because the app uses these internally. For example, some APIs are used for guest checkout process.

Some of these can be seen by reviewing underlying code:

/vendor/magento/module-customer/etc/webapi.xml

<route url="/V1/customers" method="POST">
        <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
        <resources>
            <resource ref="anonymous"/>
        </resources>
    </route>

As you can see the resource is hard coded to allow anonymous. So basically some APIs will not adhere to configuration settings in the UI.

I would recommend starting by reviewing the webapi.xml file of the particular API you are concerned about. If you really want to change this you will need to do a customization that overrides the resource in the appropriate webapi.xml file.

Personally, I am not a fan of the approach Magento took. In my view, open APIs are a bad practice. I did put in a feature request asking Magento to review this issue and have a solution that would not require anonymous access to the APIs.

Answer 3

I tried the solutions listed here and none really worked for me. di compile isn't working because there are tons of syntax errors in the code. We're on version 2.3.4 and our webhosts did the most recent upgrade. Near term, we're going to move off M2.

In Magento documentation is mention of webapi.xml controlling access. I performed a find command looking for "webapi.xml" as the file name. Of the 60 results, vendor/magento/module-customer/etc/webapi.xml looked promising, especially seeing the createAccount method.

<!-- Customer Account -->
<route url="/V1/customers/:customerId" method="GET">
    <service class="Magento\Customer\Api\CustomerRepositoryInterface" method="getById"/>
    <resources>
        <resource ref="Magento_Customer::customer"/>
    </resources>
</route>
<route url="/V1/customers" method="POST">
    <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
    <resources>
        <resource ref="anonymous"/>
    </resources>
</route>

Near line 128, I noticed the anonymous... copied this file to save the original and then edited that section to:

<!-- Customer Account -->
<route url="/V1/customers/:customerId" method="GET">
    <service class="Magento\Customer\Api\CustomerRepositoryInterface" method="getById"/>
    <resources>
        <resource ref="Magento_Customer::customer"/>
    </resources>
</route>
<route url="/V1/customers" method="POST">
    <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
    <resources>
        <resource ref="Magento_Customer::customer"/>
    </resources>
</route>

---

Since this change, there have only been a couple of spam customer accounts created overnight. These seem to have some kind of programmatic syntax like ThomasHap ThomasHapZM. I am next going to see if I can delete accounts via SQL... there are several thousand of this kind of account. To get these, I'll see how the customer table is populated in the admin and then also search for empty state, etc, along with the first and last names containing the same sequence.

Before experimenting with this kind of approach, try to contemplate the wider affects of the restriction. I do not know if changing all anonymous to something more contextually relevant for the module will crash your site. We haven't yet had anyone complain about not creating an account, so my change worked for our website.

If you have ssh access, this command can help you find anonymous Web APIs:

find . -name webapi.xml -print0 | xargs -0 grep -n 'anonymous'