Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)

Question

I was having an issue on a clients Staging environment where I was trying to use the Sitecore Item API to get items and I was getting an 403 error. It worked fine locally, I have a login method that sets the cookie and lets me get an item via the Item API. However on the Staging servers where CD and CA are on separate load-balanced servers this isn't working.

This is sample of the code I'm using to get an item using the login cookies created in the login method:

           HttpWebRequest request = WebRequest.CreateHttp($"https://{_baseAPIUrl}/sitecore/api/ssc/item/{HttpUtility.UrlEncode(parentItemId)}/children?includeStandardTemplateFields=true");
            request.Method = "GET";
            request.ContentType = "multipart/form-data";
            request.CookieContainer = loginCookies;

            using (WebResponse response = request.GetResponse())
            {
                using (Stream stream = response.GetResponseStream())
                {
                    using (StreamReader streamReader = new StreamReader(stream))
                    {
                        string responseContent = streamReader.ReadToEnd();
                    }
                }
            }

The error I get back is (403) Forbidden, even though the item definitely exists in Sitecore and the user has access to the item. I've tried multiple items too.

If I look in the logs I get:

Unauthorised request (originated from IP : x.y.z.a) for Sitecore.Services.Infrastructure.Sitecore.Controllers.ItemServiceController

I knew the if you inherit from ServicesApiController you need to exclude the controller from the security policy you use it by adding an allowedController element under: api/services/configuration/allowedControllers. However this didn't work for me as my controller is just an standard ApiController and I want to keep it this way to de-couple it from Sitecore.

Further details on the Item API can be found here: https://doc.sitecore.net/sitecore_experience_platform/developing/developing_with_sitecore/sitecoreservicesclient/the_restful_api_for_the_itemservice

Answer 1

The issue here turned out to be the Sitecore.Services.SecurityPolicy setting.

By default it only allows local requests to the API and as I have more servers in the mix and a load balancer on Staging I needed to allow remote requests with a patch file like so:

<settings>
    <setting name="Sitecore.Services.SecurityPolicy">
        <patch:attribute name="value" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" />
    </setting>
</settings>

There is more info on this here:

https://doc.sitecore.net/sitecore_experience_platform/developing/developing_with_sitecore/sitecoreservicesclient/sitecoreservicesclient_security

If anyone knows a better way to handle this then please let me know.

Answer 2

Google took me to this question/answer which was similar to my problem. In my case I faced a similar problem with Sitecore JSS returning 403 when calling /sitecore/api/layout/render/jss?item=/&sc_apikey={APIKEY Guid}

Turns out the problem for me was someone used a Sitecore version 8 license to build a Sitecore 9 instance :-(

Answer 3

It is because your Sitecore instance does not have JSS enabled license.

To verify it, open your Sitecore content tree and find "Licenses" option (Upper Right hand side), if the list is not showing JSS there then you need to get/update your current Sitecore license.