0

In the developer docs I've found the option to unrestrict API access. Is there an option to restrict access to the API for everything i.e. nothing is anonymous? Or is there a way to disable the magento API?

Maybe I misunderstand but seems like bots can spam your API endpoint to retrieve a lot of information.

https://devdocs.magento.com/guides/v2.3/rest/anonymous-api-security.html

Update

Am I correct in saying that Magento 1 doesn't allow anonymous access?

  • If you disable Magento 2 API, your checkout won't work anymore. – Jonathan Ribas Jun 10 at 21:11
  • Do you think this is a good idea? Surely it would have been a good idea to automatically generate a checkout api user on install and use this user on the checkout? – Dominic Xigen Jun 10 at 21:36
  • If you want to protect the then i suggest to use Web firewall. The application cannot stop hitting at URL & rest points.If you have too bot traffic at the network level.So suggest using Web-firewall – Amit Bera Jun 11 at 3:52
  • there is only God and one crazy magento developer know why API works this way... – MagenX Jun 11 at 9:56
  • @AmitBera Sounds good. Am I right in saying Magento 1 doesn't allow anonymous access? – Dominic Xigen Jun 11 at 11:26
1

using nginx correct way would be to map all API endpoints and configure some access logic.

map $request_uri $api_access {
        default 0;
        ~/(.*)/V1/carts/mine                        0; # example to pass?
        ~/(.*)/async/bulk/V1/customers              1;
        ~/(.*)/V1/customers(?!/me)                  1;
        ~/(.*)/V1/customers/password                1;
        ~/(.*)/V1/customers/resetPassword           1;
        ~/(.*)/V1/customers/isEmailAvailable        1;
        ~/(.*)/V1/guest-carts/                      1;
        ~/(.*)/V1/integration/                      1;
        ~/(.*)/V1/products-render-info              1;
        ~/(.*)/V1/search                            1;
        ......
        ......
        map every endpoint you like!
}

if ($api_access) { 

    some logic to log / verify / limit access;
    set $foo bar;
    rewrite @to_magento;

}

disable guest checkout is also good option, today in online business is better to know your customers are legit.

  • have you restricted API access in anyway? – Dominic Xigen Jun 14 at 16:33
  • you can block it completely and only allow access for specific use. like ERP etc... – MagenX Jun 14 at 16:51
  • i believe that API must be separate from application itself, running remotely only, running it within the application is stupid. – MagenX Jun 14 at 16:56
  • I have exactly the same feeling. Although I felt stupid making a fuss about it. But it just didn't sit me right either. – Dominic Xigen Jun 14 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.