0

In the developer docs I've found the option to unrestrict API access. Is there an option to restrict access to the API for everything i.e. nothing is anonymous? Or is there a way to disable the magento API?

Maybe I misunderstand but seems like bots can spam your API endpoint to retrieve a lot of information.

https://devdocs.magento.com/guides/v2.3/rest/anonymous-api-security.html

Update

Am I correct in saying that Magento 1 doesn't allow anonymous access?

Improve this question
5
  • If you disable Magento 2 API, your checkout won't work anymore.
    – Jonathan Ribas
    Commented Jun 10, 2019 at 21:11
  • Do you think this is a good idea? Surely it would have been a good idea to automatically generate a checkout api user on install and use this user on the checkout?
    – Dominic Pixie
    Commented Jun 10, 2019 at 21:36
  • If you want to protect the then i suggest to use Web firewall. The application cannot stop hitting at URL & rest points.If you have too bot traffic at the network level.So suggest using Web-firewall
    – Amit Bera ♦
    Commented Jun 11, 2019 at 3:52
  • there is only God and one crazy magento developer know why API works this way...
    – MagenX
    Commented Jun 11, 2019 at 9:56
  • @AmitBera Sounds good. Am I right in saying Magento 1 doesn't allow anonymous access?
    – Dominic Pixie
    Commented Jun 11, 2019 at 11:26

1 Answer 1

Reset to default
1

using nginx correct way would be to map all API endpoints and configure some access logic.

map $request_uri $api_access {
        default 0;
        ~/(.*)/V1/carts/mine                        0; # example to pass?
        ~/(.*)/async/bulk/V1/customers              1;
        ~/(.*)/V1/customers(?!/me)                  1;
        ~/(.*)/V1/customers/password                1;
        ~/(.*)/V1/customers/resetPassword           1;
        ~/(.*)/V1/customers/isEmailAvailable        1;
        ~/(.*)/V1/guest-carts/                      1;
        ~/(.*)/V1/integration/                      1;
        ~/(.*)/V1/products-render-info              1;
        ~/(.*)/V1/search                            1;
        ......
        ......
        map every endpoint you like!
}

if ($api_access) { 

    some logic to log / verify / limit access;
    set $foo bar;
    rewrite @to_magento;

}

disable guest checkout is also good option, today in online business is better to know your customers are legit.

Improve this answer
4
  • have you restricted API access in anyway?
    – Dominic Pixie
    Commented Jun 14, 2019 at 16:33
  • you can block it completely and only allow access for specific use. like ERP etc...
    – MagenX
    Commented Jun 14, 2019 at 16:51
  • i believe that API must be separate from application itself, running remotely only, running it within the application is stupid.
    – MagenX
    Commented Jun 14, 2019 at 16:56
  • I have exactly the same feeling. Although I felt stupid making a fuss about it. But it just didn't sit me right either.
    – Dominic Pixie
    Commented Jun 14, 2019 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.