2

I've been trying to use Sitecore SSC REST API to create an item. I can login, but that is as far as I get - every other request (even to get an item) returns forbidden.

I've already changed the Sitecore.Services.SecurityPolicy to ServicesOnPolicy.

I also don't quite understand how it authenticates the subsequent requests (no api key). I thought it used cookies. The login returns 4 cookies and I have tried using the one that makes sense but still no luck.

Does anyone had success with the API to get item or create item?

The only success I had was by allowing anonymous User. I have also set sitecore/serviceAPI as administrator.

Improve this question
1
  • I had the security policy setup properly and the request going properly too, but it turns out i had some rewrite rules that were redirecting my login auth, resulting in not getting the right cookies back. You are supposed to get a AspNet.Cookies back and use that token, and i wasn't getting that one back. Removed that rewrite rule and now works fine. FYI Sitecore 9.2
    – nic
    Nov 25, 2019 at 3:15

1 Answer 1

Reset to default
3

It’s a bit hard to know what’s going on without seeing your code and config and knowing your Sitecore version but some things to check are:

Login Cookies

Are you getting the login cookies from the login endpoint and passing the login cookies in your request to the API? Here is an example of a get item request. The login cookies are created by a separate request which I’ve not included the code for.

HttpWebRequest request = WebRequest.CreateHttp($"https://{_baseAPIUrl}/sitecore/api/ssc/item/{HttpUtility.UrlEncode(parentItemId)}/children?includeStandardTemplateFields=true");
            request.Method = "GET";
            request.ContentType = "multipart/form-data";
            request.CookieContainer = loginCookies;

            using (WebResponse response = request.GetResponse())
            {
                using (Stream stream = response.GetResponseStream())
                {
                    using (StreamReader streamReader = new StreamReader(stream))
                    {
                        string responseContent = streamReader.ReadToEnd();
                    }
                }
            }

Security Policy

Check your security policy setting is correct. I’d recommend the following which allows remote requests:

<settings>
    <setting name="Sitecore.Services.SecurityPolicy">
        <patch:attribute name="value" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" />
    </setting>
</settings>

The API Docs for 9.0 are here:

https://doc.sitecore.com/developers/90/sitecore-experience-manager/en/the-restful-api-for-the-itemservice.html

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.