Required Auth not respected for PUT /api/apps/{appName}/states/{serviceName}

[drik98]

When PREvant is configured to require authentication, all write operations such as creating or deleting an app fail when the user is not logged in. However, it is still possible to start or stop the service of any app without being authenticated.

Is this behavior intended or should starting/stopping services also require authentication?

[schrieveslaach]

I simply wasn't sure if this should be authenticated or not. What is your view on it?

[drik98]

I am also not 100% confident that securing it would be necessary. You cannot "break" as much by starting/stopping a service. But my first natural assumption was that every access that could be considered "writing" should be restricted.