7

I am creating a Web API (Controller) inside my Sitecore solution by inheriting ServicesApiController and EnableCors attribute. This service will be called from any IPhone/Android Application (currently not sure how they will call).

For initial testing, I created an external console application and calling this API controller inside this.

Then I am loading my Sitecore page and attaching my solution to this (w3wp.exe) process in debug mode, also a breakpoint on my API method.

It is getting called successfully till I am in debugging mode. My external console application is unable to call this API controller method when it is not in debugging mode. I am unaware of any settings that I need to do to get this service called from an external application, while it is hosted in upper environments (Prod/QA).

Are there any configuration settings that I need to modify (only for this API controller and method) without compromising the security for other items?

3

There should be nothing related to debug mode, can you please check it again? If still same problem do below settings:

  1. Make a Log for security related stuffs or other variables in a processor before/after below processor just to check what your request is doing.
<processor type="Sitecore.ItemWebApi.Pipelines.HttpRequest.CheckMode, Sitecore.ItemWebApi" patch:source="Sitecore.ItemWebApi.config"/>
  1. I'm sure you must have applied below settings, still mentioning here, coz being developers sometimes we miss small things :).

    Allow anonymous access or request through valid credentials in the \App_Config\Include\Sitecore.Speak.ItemWebApi.config file like below. Also, Make sure to give proper site name, here it's "website".

<site name="website">
    <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
    <patch:attribute name="itemwebapi.access">ReadOnly</patch:attribute>
    <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>
</site>

OR in Sitecore.Services.Client.config file, do below changes.

<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

For more details, you can refer page#13-15 of the Web API PDF guide - https://sdn.sitecore.net/upload/sdn5/modules/sitecore%20item%20web%20api/sitecore_item_web_api_developer_guide_sc66-71-usletter.pdf

| improve this answer | |
  • Hi Yogesh. I am trying to create a Web API that will do some authentication and return the web token with HttpStatusCode. I think what you are talking about is the internal Web API which is available with Sitecore. This is my own custom web api that will be called by third party and is part of my Sitecore Solution. I followed the above steps but it didn't worked. Sorry I am a newbie. – Amin Sayed Sep 22 '16 at 13:45
  • Yeah, I know, but it really looks weird that code works good in debug mode, not without. I faced such situation (not in web apis), Still, I would suggest to log something in the httpRequestBegin pipelines of ItemWebAPI. – Yogesh Patel Sep 22 '16 at 13:48
3

So I had an issue with this custom Web API hosted inside my Sitecore solution, that will be used by a third party to call upon some Authentication and Authorization functionality. I did the following things to make it work:

  1. I mistakenly named my API as ApiController which is actually a built-in Abstract class, so changed it to CustomerAPIController

  2. Removed Cors, as this was no more required.

  3. Inherit from Sitecore.Services.Infrastructure.Web.Http.ServicesApiController

  4. Added this controller in the allowed list.

The third party would send some JSON (along with username, password, deviceId) without any Credentials (to access our API) and we need to have someway to accept these parameters, process/validate it and create and JWT along with Response Status message (200, 401 etc)

| improve this answer | |
2

By enabling CORS you are enabling Cross Origin Resource Sharing. You would need to supply the domains that would be allowed to call your endpoint. As you are not making a call from an external domain, but from within an App, your request will be cancelled even before any method has been executed, as it's not allowed: https://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Another problem that often occurs is not specifying or specifying the wrong contenttype for the request. If you are posting/requesting xml/application data/whatever, but the apicontroller only works with application/json, this will break as well.

| improve this answer | |
  • Hey Bas, this API will be called by an External Application. Anyways its resolved. Please check my answer. – Amin Sayed Oct 11 '16 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.