Closed theredcameron closed 2 years ago
Is there a need to authenticate people for this API endpoint? I don't believe the information returned is sensitive, after all it's exactly what you'd find in /u/groupbot's comment history
I mean, in general it's good practice to require authentication for an API path unless it's an open API for public use. In this case, it's strictly for the web interface for what I'm assuming will be for mods, even though we don't currently use it.
This was actually created for /u/inhumantsar and their bot /u/tacostats, so it is for public use. I might want to add authentication later, but for now I'd like to keep it open since I don't think there's any harm and it'll make development easier for them
I noticed it wasn't checking if the user is authorized. We should make sure that's added to it.