4

My company uses SharePoint for their public website by allowing anonymous access. Some of our lists and document libraries have permissions to only allow certain users to be able to access them. I'm not sure exactly what our site's configuration is, but we do only have one site.

I recently discovered that despite these permissions, all of our content is anonymously and publicly available through web services. I created a small javascript soap/ajax web services script that retrieves all list content. To be fair, I've tested this as well on other SharePoint sites and am able to retrieve much of their list/document data.

Is there a way we should be extending the list/library permissions to web services, or restricting web services access? Or, is the best practice to create multiple sites - a public and private version?

|improve this question
  • Web services respect security. Were you calling the web services anonymously? Are you trying to disallow anonymous users from using the web services entirely? – Kit Menke Jun 28 '11 at 16:07
  • I'm not trying to disallow anonymous users. Our List web service (and possibly some others) do not respect security - is it possible we've set something wrong in the web.config file? – Eric Di Bari Jun 28 '11 at 17:05
  • If you are using ajax then it will run under whatever account you open the page with. Either your list permissions are set to allow anonymous users or the account you are using has access. – Kit Menke Jun 28 '11 at 17:09
  • We've set list permissions and pages - when accessing a page or list through a web browser it requires authentication. The web service call completely ignores permissions. Is it possible the anonymous account has too many permissions? Where is that changed? – Eric Di Bari Jun 28 '11 at 17:18
5

SharePoint web services respect security. Most likely, this is simply a configuration issue.

According to this article, there are two main ways anonymous users can be granted access:

  1. Web level
  2. List/library level

It sounds like currently the site is configured at the web level for anonymous access. I would look into disabling that and instead enabling it only on the specific lists/libraries you want anonymous users to have access to.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.