How do I control access to Custom Item Web API controllers?

Question

I am creating a Web API (Controller) inside my Sitecore solution by inheriting ServicesApiController and EnableCors attribute. This service will be called from any IPhone/Android Application (currently not sure how they will call).

For initial testing, I created an external console application and calling this API controller inside this.

Then I am loading my Sitecore page and attaching my solution to this (w3wp.exe) process in debug mode, also a breakpoint on my API method.

It is getting called successfully till I am in debugging mode. My external console application is unable to call this API controller method when it is not in debugging mode. I am unaware of any settings that I need to do to get this service called from an external application, while it is hosted in upper environments (Prod/QA).

Are there any configuration settings that I need to modify (only for this API controller and method) without compromising the security for other items?

Answer 1

There should be nothing related to debug mode, can you please check it again? If still same problem do below settings:

1. Make a Log for security related stuffs or other variables in a processor before/after below processor just to check what your request is doing.

<processor type="Sitecore.ItemWebApi.Pipelines.HttpRequest.CheckMode, Sitecore.ItemWebApi" patch:source="Sitecore.ItemWebApi.config"/>

2. I'm sure you must have applied below settings, still mentioning here, coz being developers sometimes we miss small things :).

   Allow anonymous access or request through valid credentials in the \App_Config\Include\Sitecore.Speak.ItemWebApi.config file like below. Also, Make sure to give proper site name, here it's "website".

<site name="website">
    <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
    <patch:attribute name="itemwebapi.access">ReadOnly</patch:attribute>
    <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>
</site>

OR in Sitecore.Services.Client.config file, do below changes.

<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

For more details, you can refer page#13-15 of the Web API PDF guide - https://sdn.sitecore.net/upload/sdn5/modules/sitecore%20item%20web%20api/sitecore_item_web_api_developer_guide_sc66-71-usletter.pdf

Answer 2

So I had an issue with this custom Web API hosted inside my Sitecore solution, that will be used by a third party to call upon some Authentication and Authorization functionality. I did the following things to make it work:

1. I mistakenly named my API as ApiController which is actually a built-in Abstract class, so changed it to CustomerAPIController

2. Removed Cors, as this was no more required.

3. Inherit from Sitecore.Services.Infrastructure.Web.Http.ServicesApiController

4. Added this controller in the allowed list.

The third party would send some JSON (along with username, password, deviceId) without any Credentials (to access our API) and we need to have someway to accept these parameters, process/validate it and create and JWT along with Response Status message (200, 401 etc)

Answer 3

By enabling CORS you are enabling Cross Origin Resource Sharing. You would need to supply the domains that would be allowed to call your endpoint. As you are not making a call from an external domain, but from within an App, your request will be cancelled even before any method has been executed, as it's not allowed: https://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api

Another problem that often occurs is not specifying or specifying the wrong contenttype for the request. If you are posting/requesting xml/application data/whatever, but the apicontroller only works with application/json, this will break as well.