I have been following Anders Laub's tutorials on implementing some WebAPI controllers using ServicesApiController and just like at the bottom of this page I received the 403 Forbidden error when making the API call. I changed the Sitecore.Services.SecurityPolicy from ServicesLocalOnlyPolicy to ServicesOnPolicy and confirmed that the calls now work with this new setting.

Does this create a security risk that I should be concerned about? If I understand correctly, this security setting exposes Sitecore's internal API to remote clients and somebody with an understanding of Sitecore's API would be able to write their own calls to mess with things they shouldn't be messing with. Am I correct in this understanding?

Is there a simple enough way to secure my website from malicious API calls or should I find an alternative method of enabling WebAPI functionality that doesn't use ServicesApiController?

  • The short short answer is yes it is a security risk. Default cors settings will prevent cross origin requests to your webapi endpoint but you should also implement some form of security: asp.net/web-api/overview/security Apr 6, 2017 at 15:38

1 Answer 1


What if you just patch your custom controllers into the <allowedControllers> section in Sitecore.config, instead of changing the Security Policy.

                      <allowedController desc="DummyCustom">Namespace.DummyController, Dummy.Assembly</allowedController>
  • This is what I ended up doing in the end. It was the cleanest and simplest solution I found.
    – Iceape
    May 15, 2017 at 9:04
  • This is the best solution
    – koga73
    Jun 27, 2018 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.