Anonymous access = huge web services security hole?

Question

My company uses SharePoint for their public website by allowing anonymous access. Some of our lists and document libraries have permissions to only allow certain users to be able to access them. I'm not sure exactly what our site's configuration is, but we do only have one site.

I recently discovered that despite these permissions, all of our content is anonymously and publicly available through web services. I created a small javascript soap/ajax web services script that retrieves all list content. To be fair, I've tested this as well on other SharePoint sites and am able to retrieve much of their list/document data.

Is there a way we should be extending the list/library permissions to web services, or restricting web services access? Or, is the best practice to create multiple sites - a public and private version?

Answer 1

SharePoint web services respect security. Most likely, this is simply a configuration issue.

According to this article, there are two main ways anonymous users can be granted access:

1. Web level
2. List/library level

It sounds like currently the site is configured at the web level for anonymous access. I would look into disabling that and instead enabling it only on the specific lists/libraries you want anonymous users to have access to.