Restricting access to anonymous web endpoints

Magento 2 allows some REST endpoints to be accessed by unauthenticated (anonymous) users. Many of these endpoints allow a customer to have a robust shopping experience on the website without having to log in.

A subset of these endpoints can return information about products, promotions, and storefronts that a merchant might consider proprietary. For example, Catalog module endpoints can provide information about an item’s pricing and quantity, as well as items that are currently not for sale. The CMS module could reveal information about upcoming promotional landing pages and coupons. The Store module can reveal too much information about individual websites.

For this reason, by default, Magento 2 now prevents anonymous users from accessing the endpoints that could reveal sensitive information. When the feature is enabled, the user must have administrator privileges to execute the affected endpoints.

The following table lists the endpoints that are no longer available to an anonymous user by default:

If the list of endpoints that are inaccessible to anonymous users must be updated for a third-party extension, an integrator can add to their extension’s di.xml file to update or replace the functionality defined in the WebapiSecurity module.

The following APIs remain accessible to anonymous users. Most of these must remain accessible to support the checkout and add-to-cart Ajax functionalities.