Sitecore Layout Service is returning 400 Bad Request for JSS requests

Question

I have followed all the steps in the JSS Server Setup guide: https://jss.sitecore.com/docs/getting-started/jss-server-install

And I have followed all the steps in the Configuring the Sitecore server to receive the JSS app section of the JSS App Deployment guide: https://jss.sitecore.com/docs/getting-started/app-deployment

However, when I reach the Verification step of the app deployment guide, I receive a HTTP 400 - Bad Request. The guide mentions that I should be sure to specify the API key I created in an earlier step. I have confirmed that I've created the API key and that the key/ID is correct.

Why am I still receiving a 400 status code?

Answer 1

There are several reasons you may receive a HTTP 400 - Bad Request response when performing a Layout Service request. Here are a few suggestions to help troubleshoot:

1. Is your API Key item published? If your site is not using the master database, the API Key item needs to be published.

2. Ensure (again) that the API key value matches the API Key item ID in Sitecore. The default API Key resolver uses the API Key item ID as the key value. Alternatively, if you're using a custom API Key resolver, ensure that the value you're providing via the API key querystring parameter matches the value resolved by your custom resolver.

3. It is possible to change the API Key parameter name via the following Sitecore setting: Sitecore.Services.ApiKeyParams. If you have customized that setting, ensure that the API key parameter name matches the value defined in the setting. By default, the value is sc_apikey.

4. Have you deployed a config file for your JSS app? The config file will have a site definition to ensure that the Layout Service URL you're requesting is resolving to the correct Sitecore site.

5. Have you provided a value for the item querystring parameter in your Layout Service request? e.g. /sitecore/api/layout/render/jss?item=/my-item

6. Have you provided a named configuration value in your Layout Service request? e.g. jss, custom - /sitecore/api/layout/render/jss, /sitecore/api/layout/render/custom

7. It is possible to provide an API Key for a Layout Service request via querystring parameter (recommended) and/or via HTTP header (the header name is the same as the querystring parameter name). If, for whatever reason, you happen to be providing the API Key via both querystring parameter and HTTP header for a Layout Service request, ensure that the querystring parameter and header values match. (Also note that it is advised to choose either querystring or HTTP header as a mechanism for providing the API Key, but not both simultaneously)

If none of the above suggestions resolve your issue, the problem is likely not originating from Layout Service. At that point, you should inspect the Sitecore log for potentially useful troubleshooting information. You may also want to confirm that the 400 status code is originating from the Sitecore server and not something on your network that is potentially handling the request.

Answer 2

In my case, the issue was with the Sitecore API key.

I resolved it by setting AllowedControllers to *.

The documentation explains AllowedControllers:

A semicolon-separated list of controllers allowed to use the API key. You can use the "*" wildcard character to allow all controllers.

For example: CustomService.Controllers.ApiKeyAttributeController

How it works is that when the API key is used with the OData Item Service, Sitecore.Services.Client validates the API key and checks if the controller is listed in the AllowedControllers property. If the controller is not listed, a bad request error (HTTP status code 400) will be thrown.

Note that is is best practice to explicitly list specific controllers instead of specifying a wildcard (*).