Skip to content

Commit f504f3d

Browse files
authored
Merge branch 'master' into wrap-line
2 parents dc04d19 + 7e98c46 commit f504f3d

File tree

2 files changed

+11
-6
lines changed

2 files changed

+11
-6
lines changed

docs/ecommerce-applications/magento-2/how-to-protect-the-magento-2-api.md

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@ myst:
66
title: How to protect the Magento 2 API? | Hypernode
77
redirect_from:
88
- /en/ecommerce/magento-2/how-to-protect-the-magento-2-api/
9+
- /knowledgebase/protecting-the-magento-2-api/
910
---
1011

1112
<!-- source: https://support.hypernode.com/en/ecommerce/magento-2/how-to-protect-the-magento-2-api/ -->
1213

1314
# How to Protect the Magento 2 API
1415

15-
**The Magento team released security update**[**Magento 2.0.3**](https://magento.com/security/patches/magento-203-security-update)\*\*on March 30th 2017. This release contains a security fix that restricts access to anonymous web APIs.\*\*\*\*[Read more.](https://magento.com/security/best-practices/restricting-access-anonymous-web-apis)\*\***We recommend you to**[**update your Magento**](how-to-update-magento-2.md)**version to Magento 2.0.3 instead of blocking the API.**
16+
```{note}
17+
The Magento team released security update [Magento 2.0.3](https://magento.com/security/patches/magento-203-security-update) on March 30th 2017. This release contains a security fix that restricts access to anonymous web APIs. [Read more.](https://magento.com/security/best-practices/restricting-access-anonymous-web-apis) We recommend you to [update your Magento](how-to-update-magento-2.md) version to Magento 2.0.3 instead of blocking the API.
18+
```
1619

1720
In March 2016, Paul Bosselaar and others discovered that the Magento 2 API by default discloses information that can be considered private:
1821

@@ -40,21 +43,22 @@ If you need to allow one or more of these URLs to be accessable, you can easily
4043

4144
Modify the lines of the following block:
4245

43-
```
46+
```nginx
4447
location ~ ^/(pub/)?(rest|soap)(/.+)?/V1/(products|store/storeViews|store/storeConfigs)/?$ {
45-
return https://support.hypernode.com/knowledgebase/protecting-the-magento-2-api/;
48+
return https://support.hypernode.com/knowledgebase/protecting-the-magento-2-api/;
4649
}
4750
```
4851

4952
When full access to the API is needed, the easiest way to do this is done with `/data/web/nginx/server.magento2api` to emtpy the file. An alternative would be to put all the lines in comment to deactivate the protection.
5053

5154
If you do not require the API, it is recommended to block it entirely. Edit the file `/data/web/nginx/server.magento2api`, remove all lines and add
5255

53-
```
54-
location ~ ^/(pub/)?(rest|soap)/ { return 403;
56+
```nginx
57+
location ~ ^/(pub/)?(rest|soap)/ {
58+
return 403;
5559
}
5660
```
5761

58-
## I 'm Not a Hypernode User
62+
## I'm Not a Hypernode User
5963

6064
You will need to do some extra work yourself. First, contact your hosting provider and ask them to help you. Otherwise you can block the API using .htaccess in case of Apache. Perhaps the Nginx rules above might work, but we do not provide support on them for non-Hypernode environments. Good luck!

docs/hypernode-platform/tools/unblocking-and-accessing-magmi-for-hypernode.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ myst:
77
redirect_from:
88
- /en/hypernode/tools/unblocking-and-accessing-magmi-for-hypernode/
99
- /knowledgebase/unblocking-and-accessing-magmi-for-hypernode/
10+
- /knowledgebase/securing-access-to-magmi/
1011
---
1112

1213
<!-- source: https://support.hypernode.com/en/hypernode/tools/unblocking-and-accessing-magmi-for-hypernode/ -->

0 commit comments

Comments
 (0)