Rest api: /V1/store/websites is reachable without a valid customer key/secret

[spotlerbob]

Steps to reproduce

1. Install Magento from develop branch.
2. Do a call to the /rest/V1/store/websites with a non empty Consumer key, Consumer key secret, Access token and Access token secret

Expected result

1. 401 status code

Actual result

1. Get a 200 status code and the list of available websites

[Bbbrinks]

I have the same issue even with empty tokens

[thomvanderboon]

Same on 2.0.2

[choukalos]

This is as designed. Intent is to allow mobile shopping apps or ajax style applications to browse the catalog and purchase. You'll notice that we block some extensible data objects (inventory) from being displayed when catalog is being accessed anonymously. You'll notice that we have 3 different sets of Quote APIs to allow anonymous, logged in user and the Admin to access those business objects. When accessing Quote anonymously ( or as a logged in user ). You can only access your (one) cart. However as an Admin you can see the cart_id and access any cart that's active.

@spotlerbob do you have a concern? Can you provide details of your concern and use case as to why we shouldn't provide anonymous access to Catalog ( same properties as is available on the store front to anonymous users ).

[Bbbrinks]

@choukalos (This is spotlerbobs actual github account) My concern is that when i'm running multiple websites on one magento instance, i might not want this information to be public. These websites/webshops might be competing webshops and i might want to hide the fact that i own both.

[choukalos]

Linking to #3786; converting to Bug

[KrystynaKabannyk]

Hello @spotlerbob, the bug is fixed now. Thanks for finding and reporting the issue!