|
6 | 6 | title: How to protect the Magento 2 API? | Hypernode |
7 | 7 | redirect_from: |
8 | 8 | - /en/ecommerce/magento-2/how-to-protect-the-magento-2-api/ |
| 9 | + - /knowledgebase/protecting-the-magento-2-api/ |
9 | 10 | --- |
10 | 11 |
|
11 | 12 | <!-- source: https://support.hypernode.com/en/ecommerce/magento-2/how-to-protect-the-magento-2-api/ --> |
12 | 13 |
|
13 | 14 | # How to Protect the Magento 2 API |
14 | 15 |
|
15 | | -**The Magento team released security update**[**Magento 2.0.3**](https://magento.com/security/patches/magento-203-security-update)\*\*on March 30th 2017. This release contains a security fix that restricts access to anonymous web APIs.\*\*\*\*[Read more.](https://magento.com/security/best-practices/restricting-access-anonymous-web-apis)\*\***We recommend you to**[**update your Magento**](how-to-update-magento-2.md)**version to Magento 2.0.3 instead of blocking the API.** |
| 16 | +```{note} |
| 17 | +The Magento team released security update [Magento 2.0.3](https://magento.com/security/patches/magento-203-security-update) on March 30th 2017. This release contains a security fix that restricts access to anonymous web APIs. [Read more.](https://magento.com/security/best-practices/restricting-access-anonymous-web-apis) We recommend you to [update your Magento](how-to-update-magento-2.md) version to Magento 2.0.3 instead of blocking the API. |
| 18 | +``` |
16 | 19 |
|
17 | 20 | In March 2016, Paul Bosselaar and others discovered that the Magento 2 API by default discloses information that can be considered private: |
18 | 21 |
|
@@ -40,21 +43,22 @@ If you need to allow one or more of these URLs to be accessable, you can easily |
40 | 43 |
|
41 | 44 | Modify the lines of the following block: |
42 | 45 |
|
43 | | -``` |
| 46 | +```nginx |
44 | 47 | location ~ ^/(pub/)?(rest|soap)(/.+)?/V1/(products|store/storeViews|store/storeConfigs)/?$ { |
45 | | - return https://support.hypernode.com/knowledgebase/protecting-the-magento-2-api/; |
| 48 | + return https://support.hypernode.com/knowledgebase/protecting-the-magento-2-api/; |
46 | 49 | } |
47 | 50 | ``` |
48 | 51 |
|
49 | 52 | When full access to the API is needed, the easiest way to do this is done with `/data/web/nginx/server.magento2api` to emtpy the file. An alternative would be to put all the lines in comment to deactivate the protection. |
50 | 53 |
|
51 | 54 | If you do not require the API, it is recommended to block it entirely. Edit the file `/data/web/nginx/server.magento2api`, remove all lines and add |
52 | 55 |
|
53 | | -``` |
54 | | -location ~ ^/(pub/)?(rest|soap)/ { return 403; |
| 56 | +```nginx |
| 57 | +location ~ ^/(pub/)?(rest|soap)/ { |
| 58 | + return 403; |
55 | 59 | } |
56 | 60 | ``` |
57 | 61 |
|
58 | | -## I 'm Not a Hypernode User |
| 62 | +## I'm Not a Hypernode User |
59 | 63 |
|
60 | 64 | You will need to do some extra work yourself. First, contact your hosting provider and ask them to help you. Otherwise you can block the API using .htaccess in case of Apache. Perhaps the Nginx rules above might work, but we do not provide support on them for non-Hypernode environments. Good luck! |
0 commit comments