Answers.Body: <p>Is the visibility for your field defined in the profile as Expose Publicly and also with the Searchable checkbox checked? You might not have to fiddle with permissions.</p>
  
  <p>Otherwise to directly answer your question, some of the other permissions might still restrict undesired actions, but among other things it gives access to the REST api (via civicrm/ajax/rest), so you'd have to check what your other actions are allowing. For example you could open a developer tools console in the browser and type (this uses civicrm/ajax/rest behind the scenes)</p>
  
  <pre><code>CRM.api3('Contact', 'create', {
    "contact_type": "Individual",
    "first_name": "John",
    "last_name": "Smith"
  }).done(function(result) {
    console.log(result);
  });
  </code></pre>
  
  <p>which would probably fail because you might not have the add contact permission enabled for anonymous, but you might be able to do something like read all the contributions, depending on what else you're allowing for anonymous.</p>
  
  <p>Also the autocomplete might be limited by whatever you restrict it to in the profile, e.g. limit to a group, but you could use the api to locate other contacts and their info.</p>
  
  <p>The bottom line is it depends what your other permissions are also allowing.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-01-22T17:49:27.440Z
Answers.LastActivityDate: 2019-01-23T01:04:36.747Z
Answers.LastEditDate: 2019-01-23T01:04:36.747Z
Answers.UserDisplayName: Demerit
Body: <p>We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm trying and have failed to find further documentation on any security considerations before allowing allowing access AJAX API to anonymous users. If we enable this are there features in CiviCRM that would prevent an anonymous user from using the AJAX API maliciously?</p>
  
Tags: <api><security><ajax>
Title: What are the security considerations before allowing access AJAX API to anonymous users?
ThreadText: # What are the security considerations before allowing access AJAX API to anonymous users?
  
  (Asked by: username_0 on 2019-01-22)
  
  We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm trying and have failed to find further documentation on any security considerations before allowing allowing access AJAX API to anonymous users. If we enable this are there features in CiviCRM that would prevent an anonymous user from using the AJAX API maliciously?
  
  **Tags:** api, security, ajax
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-01-22. Score: 3 | Accepted answer
  
  Is the visibility for your field defined in the profile as Expose Publicly and also with the Searchable checkbox checked? You might not have to fiddle with permissions.
  Otherwise to directly answer your question, some of the other permissions might still restrict undesired actions, but among other things it gives access to the REST api (via civicrm/ajax/rest), so you'd have to check what your other actions are allowing. For example you could open a developer tools console in the browser and type (this uses civicrm/ajax/rest behind the scenes)
  CRM.api3('Contact', 'create', {
    "contact_type": "Individual",
    "first_name": "John",
    "last_name": "Smith"
  }).done(function(result) {
    console.log(result);
  });
  
  which would probably fail because you might not have the add contact permission enabled for anonymous, but you might be able to do something like read all the contributions, depending on what else you're allowing for anonymous.
  Also the autocomplete might be limited by whatever you restrict it to in the profile, e.g. limit to a group, but you could use the api to locate other contacts and their info.
  The bottom line is it depends what your other permissions are also allowing.
  
  
  ---
  
  