Title: Force usage of sessionId when accessing REST service
Tags: rest-api
Question: Is there  a way to force clients of REST service to use their sessionId to access a REST service ?
I can currently access this URL without any sessionId
https://ddddddd.force.com/services/apexrest/contacts/00sddd5/employees
I did add the Rest service class RESTClass... to the Public Access Settings of the tools Sites -> Apex Class Access.
http://www.salesforce.com/us/developer/docs/apexcode/index_Left.htm#CSHID=apex_rest_code_sample_basic.htm%7CStartTopic=Content%2Fapex_rest_code_sample_basic.htm%7CSkinName=webhelp
Apex class methods that are exposed through the Apex REST API don't
enforce object permissions and field-level security by default. We
recommend that you make use of the appropriate object or field
describe result methods to check the current user’s access level on
the objects and fields that the Apex REST API method is accessing. See
Schema.DescribeSObjectResult and Schema.DescribeFieldResult.  - Exposing Data with Apex REST Web Service Methods
Schema.DescribeFieldResult F = Employee_c.Termination_Date__c.getDescribe();
F.isAccessible() returns true if user is allowed to see this field
Boy-if we have to do this for all fields even if we use a utility, that is a pain.
Comment: If you want to force authenticated access, don't add it to the public site.

Comment: @superfell Also, will proxying access via a Remote App help ? http://www.salesforce.com/us/developer/docs/api_rest/index_Left.htm#StartTopic=Content/quickstart_oauth.htm


Here is another answer: The issue is that you would like to authenticate users before allowing access to the web service, but you are exposing the web service with public access.  You will need to reduce the security to only internal users.

{'source': 'StackExchangeDataset', 'subset': 'salesforce.stackexchange.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 2, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2012:00:11/05/12', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<rest-api>', 'Title': 'Force usage of sessionId when accessing REST service', 'ViewCount': 323, 'id': 4062, 'user_AboutMe': None, 'user_AccountId': 413351.0, 'user_DisplayName': 'Vijay', 'user_Reputation': 269.0, 'user_Views': 17.0, 'user_id': 823.0}}