Which object answers, with ?site= refused on routes that take no credential.
/serve is in PUBLIC_ROUTES, so the catch-all's refusal does not cover it: an unauthenticated
GET /serve?site=<unused name> would provision a whole Drupal database, and another tenant's
name would serve their pages. An owner route may name a site (the object validates the token) and
so may a diagnostic route (dev and the measurement scripts).
Which object answers, with
?site=refused on routes that take no credential./serveis inPUBLIC_ROUTES, so the catch-all's refusal does not cover it: an unauthenticatedGET /serve?site=<unused name>would provision a whole Drupal database, and another tenant's name would serve their pages. An owner route may name a site (the object validates the token) and so may a diagnostic route (dev and the measurement scripts).