I realized that it is possible to register customers through API without authentication.


Just make a POST call to https://example.com/rest/V1/customers with JSON content:

        "email": "[email protected]",
        "firstname": "Customer Name",
        "lastname": "Customer Lastname"
    "password": "UserPassword"

What would happen if an attacker exploited this possibility to "dirty" my customer database?

How can we protect?


1 Answer 1


I solved editing /vendor/magento/module-customer/etc/webapi.xml

<route url="/V1/customers" method="POST">
    <service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
        <!-- resource ref="anonymous"/ -->
        <resource ref="self"/>

I changed ref="anonymous" to ref="self".

Now isn't accessible without authentication.

  • How can I use admin authentication token requried for my custom API. @Francesco Mineo Commented Aug 30, 2022 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.