3

I am trying to access Sitecore items using Webapi in console application its throwing an error - The remote server returned an error: (403) Forbidden.

code:-

var url = "https://sc103sc.dev.local/sitecore/api/ssc/item/110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9";
         
var request = (HttpWebRequest)WebRequest.Create(url);
request.Headers.Add("X-Scitemwebapi-Username", "admin");
           request.Headers.Add("X-Scitemwebapi-Password", "b");
            request.Method = "GET";
            request.ContentType = "application/json";
            request.CookieContainer = cookies;
            var response = request.GetResponse();

patch added :

<site name="website">
      <patch:attribute name="itemwebapi.mode">StandardSecurity</patch:attribute>
      <patch:attribute name="itemwebapi.access">ReadWrite</patch:attribute>
      <patch:attribute name="itemwebapi.allowanonymousaccess">true</patch:attribute>
</site>
0

2 Answers 2

1

You need first to authenticate with Sitecore and perform your different requests by including the authentication session.

https://doc.sitecore.com/xp/en/developers/102/sitecore-experience-manager/the-restful-api-for-the-itemservice.html 403- Forbidden. The request is not permitted for security reasons.

Code:

ublic static void Main(string[] args)
{
    try
    {
        var authUrl = "https://<domain>/sitecore/api/ssc/auth/login";
        var authData = new Authentication
        {
            Domain = "sitecore",
            Username = "admin",
            Password = "b"
        };

        var authRequest = (HttpWebRequest)WebRequest.Create(authUrl);

        authRequest.Method = "POST";
        authRequest.ContentType = "application/json";

        var requestAuthBody = JsonConvert.SerializeObject(authData);

        var authDatas = new UTF8Encoding().GetBytes(requestAuthBody);

        using (var dataStream = authRequest.GetRequestStream())
        {
            dataStream.Write(authDatas, 0, authDatas.Length);
        }

        CookieContainer cookies = new CookieContainer();

        authRequest.CookieContainer = cookies;

        var authResponse = authRequest.GetResponse();

        Console.WriteLine($"Login Status:\n\r{((HttpWebResponse)authResponse).StatusDescription}");

        authResponse.Close();

        var emailObj = new ItemRequest
        {
            ItemName = "Test APi 4",
            TemplateID = "{76036F5E-CBCE-46D1-AF0A-4143F9B557AA}",
            Title = "Test API TITLE",
            Text = "TEST API TEXT"
        };

        var url = "https://<domain>/sitecore/api/ssc/item/sitecore%2Fcontent%2Fhome";

        var request = (HttpWebRequest)WebRequest.Create(url);

        request.Method = "POST";
        request.ContentType = "application/json";
        request.CookieContainer = cookies;

        var requestBody = JsonConvert.SerializeObject(emailObj);

        var data = new UTF8Encoding().GetBytes(requestBody);

        using (var dataStream = request.GetRequestStream())
        {
            dataStream.Write(data, 0, data.Length);
        }

        var response = request.GetResponse();

        Console.WriteLine($"Item Status:\n\r{((HttpWebResponse)response).StatusDescription}");
    }
    catch (Exception ex)
    {
        Console.WriteLine($"Error occurred. Message: {ex.Message}.\r\n StackTrace: {ex.StackTrace}.\r\n InnerException: {ex.InnerException}");
    }

    Console.ReadKey();
}

Refer below link that uses Sitecore itemService Rest api and Console. https://hishaamn.wordpress.com/2020/10/04/sitecore-itemservice-rest-api/

Hope it helps!

2
  • I followed the same article but there but it does not work for me. Same issue with this as well. Commented Jul 13, 2023 at 9:07
  • What is the result in authResponse? Is it returns successfully? Commented Jul 13, 2023 at 9:20
1

Check /sitecore/admin/showconfig.aspx for the value of Sitecore.Services.SecurityPolicy:

<!--   SITECORE SERVICES SECURITY POLICY
  Specifies the Sitecore.Services.Infrastructure.Web.Http.Security.IAuthorizePolicy derived type that will set the security policy 
  for the Sitecore services.
  
  Policies:
  
  Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOffPolicy, Sitecore.Services.Infrastructure
  - Policy denies access to all Entity and Item Services
  
  Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnlyPolicy, Sitecore.Services.Infrastructure
  - Policy denies access to all Entity and Item Services from requests originating from remote clients
  
  Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure
  - Policy allows access to all Entity and Item Services
  
  Default: Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnlyPolicy, Sitecore.Services.Infrastructure      
-->

<setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnlyPolicy, Sitecore.Services.Infrastructure" />

If you want to allow access from application located on another server, you will need ServicesOnPolicy to be configured.

Be aware that this can potentially create security issues.

Read more in Sitecore documentation: https://doc.sitecore.com/xp/en/developers/103/sitecore-experience-manager/sitecore-services-client-security.html

Additionally, remember to include sitecore domain name in X-Scitemwebapi-Username

request.Headers.Add("X-Scitemwebapi-Username", @"sitecore\admin");
2
  • I tried that already. <setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy , Sitecore.Services.Infrastructure" patch:source="Sitecore.Services.Client.config"/> Commented Jul 13, 2023 at 9:53
  • try to include sitecore domain name in X-Scitemwebapi-Username request.Headers.Add("X-Scitemwebapi-Username", @"sitecore\admin");
    – Marek Musielak
    Commented Jul 13, 2023 at 10:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.