On any given Magento2 website, you can navigate to https://yourmagentostore.com/swagger and access the swagger UI for API methods.

One of the methods that you can test before being authenticated is getting a token. You get that by using the integrationAdminTokenService. All that method needs is the admin username and password.

To me this seems like a security risk. Any bot can brute Force this form to try and guess the admin credentials. So even if you created a complicated path to your admin route, here's an easy place for someone else to try and guess it.

Am I missing something? Are you supposed to disable swagger for your production environment?

While I'm at it, I guess you don't need the swagger UI, anyone can just brute Force the API integrationAdminTokenService to try and get the user credentials.

Does Magento2 have any measures in place to prevent such attacks?


You can do it by disabling the Magento Swagger module:

bin/magento module:disable Magento_Swagger

Hope it works.


According to Magento Dev docs, By default, the /swagger endpoint is open on Magento instances. Leaving it open on a public instance could potentially expose system information that should not be readable.

To close off the /swagger endpoint, disable the following modules:

  • Swagger
  • SwaggerWebapi
  • SwaggerWebapiAsync

Reference : https://devdocs.magento.com/guides/v2.4/rest/generate-local.html?itm_source=devdocs&itm_medium=search_page&itm_campaign=federated_search&itm_term=swagger

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.