I want to secure my Sitecore JSS LayoutService in such a way that only the client application (i.e. react app) can access my LayoutService API.

Please note, I am not taking about the login/logout mechanism of Sitecore, its a simple JSS-react app.

I understand Sitecore provides a SSC_APIKey logic for JSS layout service and CORS origin security mechanism out of the box plus we have options to add throttling strategies but after all this its quite easy to get the LayoutService URL and its API key in the network tab of the deployed react APP. Hence the LayoutService is publicly accessible. One can easily consume my LayoutService with these details via some tools like postman etc.

Any solution/thought is much appreciated.

2 Answers 2


Well you can't.

The one mechanism that could lock that service down with something that could not just be picked up on the network tab and restrict access to the service to only those people you decide does exist. It's called Authentication, and you're ruling that out.

If you think this through; if not authentication, what would you lock down the service on? IP Addresses? no good if it's a public website.

The second thing to consider; the LayoutService doesn't expose anything that you've not granted public access to in the first place. It very much respects Sitecore security (unless you deliberately break that, and have it running in the context of an admin user). So presumably there's nothing anyone could get via LayoutService, that they would not be able to get via your React App in the first place.

  • Fully agree. One thing you could do though is use Server-Side Rendering to hide layout service from the client. But as this data is usually public anyway, why sould you?
    – Mark Lowe
    Nov 25, 2019 at 12:50

Few Options to disbale access are

  1. network level access to the Sitecore instance from hosted node server
  2. adding a pipeline to check incoming request has a custom header key value which is passed by the node or other application when they make request.
  • This is not an answer. Post it as a comment below the question instead.
    – Marek Musielak
    Nov 25, 2019 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.