I realized that it is possible to register customers through API without authentication.


Just make a POST call to https://example.com/rest/V1/customers with JSON content:

        "email": "customer@email.com",
        "firstname": "Customer Name",
        "lastname": "Customer Lastname"
    "password": "UserPassword"

What would happen if an attacker exploited this possibility to "dirty" my customer database?

How can we protect?



I solved editing /vendor/magento/module-customer/etc/webapi.xml

<route url="/V1/customers" method="POST">
    <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
        <!-- resource ref="anonymous"/ -->
        <resource ref="self"/>

I changed ref="anonymous" to ref="self".

Now isn't accessible without authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.