none
how to lock down the URL RRS feed

  • Question

  • Hello

    I am working with a menu driven report application build using report builder 3 that was built by someone else who is no longer available.

    I have two concerns

    First, a user can simply change the URL and get right to the report server directory of files.

    Second, there are parameters being passed from menu to summary level reports and than to detail reports, these parameters are easy to change in the URL and allow users to get to data they are not meant to get to.

    Is there some way to lock down or mask the URL to stop these security concerns?

    Thank you in advance for any assistance

    Thursday, July 25, 2019 11:56 AM

All replies

  • What for security concerns? SSRS has a permissioning System and users can only access those reports where they have permissions for; even when they enter the URL.

    Olaf Helper

    [ Blog] [ Xing] [ MVP]

    Thursday, July 25, 2019 1:10 PM
  • Hi Chucky,

     

    For your first concern, as Olaf has explained, you could set permission rules for user can only get to see the reports which they are allowed to. Check SQL Server Reporting Services 2012 Permissions. Or you could simply google for SSRS permission to get better tutorial.

    For your second concern, you could set Data driven subscriptions to send user the report with only the desired parameter.  Or, you could apply parameter security, you could check the answer in  How to apply seciruty to Parameter in SSRS? This also offer plenty ways to work this out.

      

    Regards,

    Lukas


    MSDN Community Support Please remember to click Mark as Answer; the responses that resolved your issue, and to click Unmark as Answer if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.



    Friday, July 26, 2019 3:17 AM