Swagger available to the world wide web

Question

On any given Magento2 website, you can navigate to https://yourmagentostore.com/swagger and access the swagger UI for API methods.

One of the methods that you can test before being authenticated is getting a token. You get that by using the integrationAdminTokenService. All that method needs is the admin username and password.

To me this seems like a security risk. Any bot can brute Force this form to try and guess the admin credentials. So even if you created a complicated path to your admin route, here's an easy place for someone else to try and guess it.

Am I missing something? Are you supposed to disable swagger for your production environment?

While I'm at it, I guess you don't need the swagger UI, anyone can just brute Force the API integrationAdminTokenService to try and get the user credentials.

Does Magento2 have any measures in place to prevent such attacks?

Answer 1

According to Magento Dev docs, By default, the /swagger endpoint is open on Magento instances. Leaving it open on a public instance could potentially expose system information that should not be readable.

To close off the /swagger endpoint, disable the following modules:

• Swagger
• SwaggerWebapi
• SwaggerWebapiAsync

Reference : https://devdocs.magento.com/guides/v2.4/rest/generate-local.html?itm_source=devdocs&itm_medium=search_page&itm_campaign=federated_search&itm_term=swagger

Answer 2

You can do it by disabling the Magento Swagger and its dependent modules:

bin/magento module:disable Magento_Swagger Magento_SwaggerWebapi Magento_SwaggerWebapiAsync;
bin/magento setup:upgrade;
bin/magento cache:flush;
bin/magento cache:clean;

Hope it works.