API endpoints are exposed to public

[facultymatt]

Just noticed that my app's api endpoints are publicly accessible. For example, visiting http://warm-mountain-5064.herokuapp.com shows the example chat room app. Visiting http://warm-mountain-5064.herokuapp.com/messages exposes the messages in JSON.

How can we fix this? Maybe this is more of a design/ architecture issue? Some thoughts:

• Why protect endpoints if this information is going to be public on the website anyway?
• Some information, ie user passwords, should not be exposed through the API In this case they can just be blocked in the API events section.
• Other information, ie user email, could be restricted to admin / user based access through events.

Thoughts?

[facultymatt]

Should be posted in the api. Closed.