8

I was having an issue on a clients Staging environment where I was trying to use the Sitecore Item API to get items and I was getting an 403 error. It worked fine locally, I have a login method that sets the cookie and lets me get an item via the Item API. However on the Staging servers where CD and CA are on separate load-balanced servers this isn't working.

This is sample of the code I'm using to get an item using the login cookies created in the login method:

           HttpWebRequest request = WebRequest.CreateHttp($"https://{_baseAPIUrl}/sitecore/api/ssc/item/{HttpUtility.UrlEncode(parentItemId)}/children?includeStandardTemplateFields=true");
            request.Method = "GET";
            request.ContentType = "multipart/form-data";
            request.CookieContainer = loginCookies;

            using (WebResponse response = request.GetResponse())
            {
                using (Stream stream = response.GetResponseStream())
                {
                    using (StreamReader streamReader = new StreamReader(stream))
                    {
                        string responseContent = streamReader.ReadToEnd();
                    }
                }
            }

The error I get back is (403) Forbidden, even though the item definitely exists in Sitecore and the user has access to the item. I've tried multiple items too.

If I look in the logs I get:

Unauthorised request (originated from IP : x.y.z.a) for Sitecore.Services.Infrastructure.Sitecore.Controllers.ItemServiceController

I knew the if you inherit from ServicesApiController you need to exclude the controller from the security policy you use it by adding an allowedController element under: api/services/configuration/allowedControllers. However this didn't work for me as my controller is just an standard ApiController and I want to keep it this way to de-couple it from Sitecore.

Further details on the Item API can be found here: https://doc.sitecore.net/sitecore_experience_platform/developing/developing_with_sitecore/sitecoreservicesclient/the_restful_api_for_the_itemservice

12

The issue here turned out to be the Sitecore.Services.SecurityPolicy setting.

By default it only allows local requests to the API and as I have more servers in the mix and a load balancer on Staging I needed to allow remote requests with a patch file like so:

<settings>
    <setting name="Sitecore.Services.SecurityPolicy">
        <patch:attribute name="value" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" />
    </setting>
</settings>

There is more info on this here:

https://doc.sitecore.net/sitecore_experience_platform/developing/developing_with_sitecore/sitecoreservicesclient/sitecoreservicesclient_security

If anyone knows a better way to handle this then please let me know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.