4

When you don't want users to use any web services it seems like you can turn off the permission to Use Remote Interfaces. However that permission does not mention REST.

This made me wonder if there was any way to turn it off, at any level. I did some searching but couldn't find anything.

Besides that, even Limited Access grants Use Remote Interfaces. So as soon as some permissions are broken, they are granted that permission even though the perhaps stripped permission level does not grant it.

So, do you know any way to turn off the possibility to use the REST API? Either at farm level, site level or via permissions. And is there any real secure way to turn off Use Remote Interfaces?

  • If you read through the verbose logs you will see that SharePoint uses web services to communicate with itself extensively. I recommend doing the homework to identify and block only what you want to block. If you block everything you will likely reduce your security and support-ability. – ghangas Jan 13 '15 at 21:19
1

It looks like access to the REST API can not be blocked within SharePoint. The only thing that can be limited is Client Integration, which can be turned off either per webapplication or within specific permissions.

A good article can be found here ... http://www.grayston.net/2010/sharepoint-and-office-integration-lets-remove-it/ ... it also gives you an idea which other options might exist that fit with your special requirements.

0

You can do it at IIS level. Just change the web.config and use IIS URL Rewrite Rule to redirect users from url http://domain.com/_api/* to 404 or any other page.

  • That is what we did now as well. The problem is you then also have to do it for _vti_bin/client.svc. To be honest, it's not really a great solution. Not in the least becasue SP Designer uses _vti_bin/client.svc – Martijn Bijl Jun 25 '14 at 20:26
  • I know it is kind of hack. If you do not have SP facing internet I think it is not necessary to block API. You do not have to be afraid of DOS attacks and only authenticated users will have access to API functions - no security threat. You can of course add exceptions to the rule for users using SP Designer, or try to identify (do not know how) that the SPD is calling the API. – luccio Jun 26 '14 at 12:10
0

As for Use Remote Interfaces, I know it doesn't mention REST but it definitely prevents REST or any of the other client accesses listed. As for a way to "lock" that value or a way to achieve the same at a higher level, I haven't seen a way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.