Does implementing a WebApi service using ServicesApiController expose a significant security risk?

Question

I have been following Anders Laub's tutorials on implementing some WebAPI controllers using ServicesApiController and just like at the bottom of this page I received the 403 Forbidden error when making the API call. I changed the Sitecore.Services.SecurityPolicy from ServicesLocalOnlyPolicy to ServicesOnPolicy and confirmed that the calls now work with this new setting.

Does this create a security risk that I should be concerned about? If I understand correctly, this security setting exposes Sitecore's internal API to remote clients and somebody with an understanding of Sitecore's API would be able to write their own calls to mess with things they shouldn't be messing with. Am I correct in this understanding?

Is there a simple enough way to secure my website from malicious API calls or should I find an alternative method of enabling WebAPI functionality that doesn't use ServicesApiController?

Answer 1

What if you just patch your custom controllers into the <allowedControllers> section in Sitecore.config, instead of changing the Security Policy.

<sitecore>
    <api>
        <services>
            <configuration>
                  <allowedControllers>
                      <allowedController desc="DummyCustom">Namespace.DummyController, Dummy.Assembly</allowedController>
                  </allowedControllers>
            </configuration>
        </services>
     </api>
</sitecore>