HCL Domino Ideas Portal
Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.
For more information and upcoming events around #dominoforever, please visit our Destination Domino Page
I mostly disagree. The world is moving towards API first. They also report per user which makes sense from an API point of view. Although having users be able to get to this could create noise, I don't see how this is a security issue.
Our Traveler server and several client ones show the session authentication dialog and do not allow anonymous access. You've allowed anonymous access to that URL. You should block anonymous. See Thomas' comment, as well.
What is unsave to get those statistics as a user, when you are authenticated?
Those statistics are per user statistics. Per user statistics can only be queried if you have an authenticated user in the first place ;-)
So I would not see how this should be "unsave".
Also in general a best practice for any server not providing public services, you should disable anonymous access for HTTP on server level.
My traveler server does only allow HTTPS and only authenticated user access.
[ Daniel Nashed / http://blog.nashcom.de)
By default, the URL's are access protected.
Did you enable Domino Access Services on this machine?
And below URL also can be accessed by anonymous
https://hostname/api/
End users can get below info: