Greg lindquist (Customer) asked a question.

December 19, 2025 at 4:02 PM
Restricting RESTful API documentation in Sitefinity 15.3

Hi all, we are noticing the RESTful API documentation is available to the public for our .net core frontend application.

 

We see this as security concern as it can help expose private information in some cases. Is there a way to disable anonymous access to a page like https://mydomain.com/api/default/blogs/sfhelp - but still allow frontend access to the https://mydomain.com/api/default/blogs endpoint?

 

Thanks!

  • 3 answers
  • 262 views

  • Sabrie Nedzhip (Enso DX)

    Hi @Greg lindquist (Customer)​ ,

     

    There is no separate setting for the sfhelp so in your case (where you want Anonymous access for the content API endpoints) you can use a rewrite rule that redirects sfhelp to the home page.

     

    Here is a sample you can add to the Sitefinity CMS web.config file:

    1. <system.webServer>
    2. <handlers><!-- the existing handlers entries --></handlers>
    3. <rewrite>
    4. <!-- sfhelp redirect rule start -->
    5. <rules>
    6. <rule name="Redirect sfhelp to home" stopProcessing="true">
    7. <match url="^api/[^/]+/sfhelp(/.*)?$" />
    8. <action type="Redirect" url="/" redirectType="Permanent" />
    9. </rule>
    10. </rules>
    11. <!-- sfhelp redirect rule end-->
    12. </rewrite>
    13. <staticContent><!-- the static content entries --></staticContent>
    14. </system.webServer>

    I hope this works for you.

     

    Regards,

    Sabrie

    Selected as Best

  • Sabrie Nedzhip (Enso DX)

    Hi @Greg lindquist (Customer)​ ,

     

    There is no separate setting for the sfhelp so in your case (where you want Anonymous access for the content API endpoints) you can use a rewrite rule that redirects sfhelp to the home page.

     

    Here is a sample you can add to the Sitefinity CMS web.config file:

    1. <system.webServer>
    2. <handlers><!-- the existing handlers entries --></handlers>
    3. <rewrite>
    4. <!-- sfhelp redirect rule start -->
    5. <rules>
    6. <rule name="Redirect sfhelp to home" stopProcessing="true">
    7. <match url="^api/[^/]+/sfhelp(/.*)?$" />
    8. <action type="Redirect" url="/" redirectType="Permanent" />
    9. </rule>
    10. </rules>
    11. <!-- sfhelp redirect rule end-->
    12. </rewrite>
    13. <staticContent><!-- the static content entries --></staticContent>
    14. </system.webServer>

    I hope this works for you.

     

    Regards,

    Sabrie

    Selected as Best

    • Greg lindquist (Customer)

      Thanks! I'd love to see a configurable option in the future, but this is a good fix for now.

  • Jonathan Read (Progress Software)

    You could also consider using the X-SF-APIKEY. From the backend of Sitefinity add a random value to the access restriction section of your web service. In the renderer app add WebServiceApiKey to the Sitefinity node of the appsettings with your random value. Now you will have to have the header X-SF-APIKEY to access the web services. So a developer could still using them via postman if they wanted but you won't be able to access it just through the browser or at least not without dev knowledge and the key itself.