Recently a security audit has been done on our servers and applications which has ArcGIS enterprise installed on it.

Our Architecture setup :

We have ArcGIS installed on the server, ArcGIS exposes its data via its restful api for its clients which is authenticated with OAuth2 token security (Out of the box ESRI Feature) We have mobile applications for both iOS/Android and web which are built on top of Esri SDKs. Some of the features in the app consumes data from ArcGIS REST services for their functioning.

The audit reported a potential vulnerability stating that one of the REST services disclose sensitive informations including email and phone numbers even for non authenticated users.

consider web application, we make use of esri’s proxy files to manage access to our resources for them. the vulnerability is found for the following feature server query through the rest interface,


I understand this as a problem with the ArcGIS REST services, but I’m not sure about this.

What could be done to mitigate this problem?

1 Answer 1


I find it very hard to believe that non authenticated users are getting a response to the query. I would suggest you to check in the arcgis/manager/ of the service, the permissions using the "Edit service security" as explained in this documentation link. This should be set to "Private" > "Allow access to all users who are logged in". Even better will be to set this to only the specific users of the query service!

If you still have an issue, maybe a solution will be to disable the REST API HTML-based representation access. Have a look on the ESRI documentation on this link because I have not implement this my self and I am not sure how it works.

  • sorry this was enabled by default..still didn’t work out Nov 5, 2018 at 14:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.