Catch up wih the Appery.io community on our forum. Here you'll find information on the lastest questions and issues Appery.io developers are discussing.
https://forum.appery.io/
if sessionToken is omitted in REST calls to the database service, all of the data is visible.
Is there any way to restrict access to the db service only to authenticated users - ones with valid "sessionToken"s?
Yes, add ACL to each record in the collection. This way when you do a GET without a session token, no data will be returned.
Hm, so which ACL string do I have to use if I want ALL users(if logged-in/authenticated) to be able access a certain row?
Hello! There is no way to do that. Currently it can be done only using server code (use server code as a proxy to request DB).
Well, thanks for letting me know.