How to make CMS content available to an anonymous user without making the rpc endpoint anonymously accessible?

Data Services
,
1

In our application we need to show content pages to an anonymous user. Therefore we have to allow anonymous access to the dataservices rpc endpoint to load the CMS data.

However this basically removes an entire line of defense for all the business operations that are also implemented using the rpc endpoint. Because now a malicious actor is able to anonymously send business operations via the rpc endpoint and defense now relies on every rpc operation having a proper security implementation itself.

Therefore I would like to know if I can make CMS content available for anonymous users without needing to make the rpc endpoint anonymously accessible?

2

Hi. I met a similar requirement in my other project in 2023. In my opinion, it is definitely not a solution to open the complete JSON-RPC endpoint, because it would possibly damage the whole application. Our approach was to create a complete new client (say “public client”) on a different URL which accesses a new endpoint on the backend-side (we had a REST one). This endpoint is explicitly marked with no authentication and only the desired operation should be possible there - Load only specific models, put only specific documents, etc. - The target was to separate the “public endpoint” as much as we could from the “secure part” of the application.

3

Hi @stefan-grey-canyon,

UAA has configuration mgmtp.a12.uaa.authentication.unsecured.urls that will make some path of application unsecured by UAA. DS does not have any APIs that are accessible via such property right now. In your project, you can create such endpoint, use UAA configuration to make it accessible to anonymous users.

Here are some restrictions from DS side:

  1. Endpoint must not use and DS secured API. Every secure API will require authorization and these users would not able to pass it. If you need to use some secured API, you will need to provide a user for it with UAA BackendAuthorization feature.
  2. Endpoint must heavily rely on caches and do “as little as possible” to not create a door to the DoS attack

JSON-RPC is using only secured APIs, so it is not possible to have unsecured JSON-RPC operation without creating a whole json-rpc server endpoint that is unsecured.

This answer is valid for all supported DS version 37.2.0 and bellow.

4

Hi @andreas-fresh-mesa,

Currently, the CMS exclusively relies on the DS Model API through the RPC endpoint to retrieve the content models, and there is no alternative to bypass this mechanism for anonymous access.

If supporting this is a requirement for the project, please help us by raising a ticket so we can analyze its feasibility further.

Thanks.