ref view is visible without authentication #141
Description
Both /ref and /ref2 views need to be locked down to only visible by battle creator. Right now they are visible by everyone.
Should be easy enough to lock down similar to the /recap view BUT I am concerned that an unauthenticated socket connection to the zero sync server can access this data.
These are screen shots from a private tab with no authentication after loading the /ref/:id view. Anyone that connects to the websocket server could query for this data. Maybe they need to know the battle id, but this is still not good. Can we lock it down somehow in a middleware?
Metadata
Metadata
Assignees
Labels
No labels