---
title: Securing the Staging and REST web services
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

The Xperience administration application offers two services which provide communication and synchronization of content and objects between servers. Both services are disabled by default. Enable the services only if you plan to use them.

- You can enable Staging in **Settings -> Versioning & Synchronization -> Staging -> Enable staging service**.
- You can enable REST in **Settings -> Integration -> REST -> Service enabled**.

## Staging

The weakest spot of the Staging service is in the authentication process. If potential attackers obtained the user name and password for the service, they could stage a user with the administrator privilege level and gain absolute power over the system.

You can secure the staging service using two authentication options:

- **User name and password**
- **X.509 certificate**

The recommended option is to use the X.509 certificates for authentication, as certificates generally provide better security. See [Using X.509 authentication](https://docs.kentico.com/13/deploying-websites/content-staging/using-x-509-authentication.md) for more details.

## REST

The REST service provides access to the objects in Xperience, so a potential attacker could obtain or modify any data in the system.

You can secure the REST service by using **HTTPS** (SSL/TLS) along with Basic authentication. See [Authenticating REST requests](https://docs.kentico.com/13/integrating-3rd-party-systems/xperience-rest-service/authenticating-rest-requests.md) and [Configuring SSL](https://docs.kentico.com/13/securing-websites/deploying-websites-to-a-secure-environment/configuring-ssl.md) for more details.

You can also use the **Hash parameter authentication** for authenticating individual REST requests. You only need to generate the hash in the administration interface and add the hash to URL. This URL then serves a particular REST request without the need of further authentication.

The REST service should optimally check the correct authentication with every request. However, because of other Xperience services, which need some HTTP context within WCF, the checks are not performed every time. You can change this behavior by setting the _aspNetCompatibilityEnabled_ key to **false** in the **** section of the web.config file:

```xml

<serviceHostingEnvironment aspNetCompatibilityEnabled="false" />

```

### Best practice

The best practice with REST is to **assign a dedicated user** to the service, grant the user **permissions only for the desired objects**, configure access through **HTTPS** and disable the **aspNetCompatibilityEnabled** mode.