Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having issues accessing a Magento API, as the magento folder is password protected. Is there a way to add an exception to this, so that any request to the API is allowed, but all other requests are blocked?

I am using IIS7.5 and Plesk 10.

share|improve this question
How are you password protecting the folder, and how is the API call made? – Scott Forsyth - MVP Sep 28 '11 at 14:09
Password protection is configured via Plesk "Password Protected Directories", and the API call is made using SOAP, however I believe the problem is due to Magento making an internal call to its own API - I do not know how it does this (assume it is also SOAP) – Gavin Coates Sep 28 '11 at 15:43

I would first confirm that the issue is the password protection. If you turn off the password protection, does it work? In other words, is that the only cause of the failure.

Do you know how Plesk sets the password protection? Does it use IIS's built in features? If so, you can manually grant access to the API page only. If Plesk has a custom way to handle auth, you can choose to use IIS's auth instead of Plesk instead. Basically turn it off in Plesk, but disable the anonymous user on the site in IIS.

share|improve this answer
The issue is purely down to the password protection - disabling it causes the system to work fine, enabling it causes an access denied error message. I do not know how Plesk sets the password protection, that is the reason I am posting this question. How do I disable the anonymous user in IIS? – Gavin Coates Sep 29 '11 at 9:52
I don't know Plesk really so I can't speak into that part, but in IIS, you can open IIS Manager, navigate to the site -> authentication -> click on anonymous -> disable. That essentially password protects it, but it allows back end code to still access the site. If your API breaks after this, then find out the file of the API and specifically turn on the anonymous user for just that path. – Scott Forsyth - MVP Sep 29 '11 at 19:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.