API can be queried without any authentication details

EventStoreDB
1

Hi all,

I’ve noticed, that by default you can query the API without of authentication, e.g.:

curl -X GET http://127.0.0.1:2114/streams//0

Is any configuration change required to prevent it?

Thanks

2

there are ACLs that can be defined per stream as well as defaults overall

https://eventstore.org/docs/server/access-control-lists/