PUT/DELETE - allow publically

[adamwojt]

From Reddit user:

The API is publicly accessible, right? Thats how the CLI tool works? Cuz havint methods for listing all stored urls, as well as (non-authorized) methods for modifying/deleting them is a terrible idea imo.

EDIT: Ok, from experimenting, it seems like those 3 routes are protected (requiring auth credentials). So those are only available to the admin then, i guess.

Problem i still see:

• Thats not documented in the readme
• PUT/DELETE require a trailing slash after the token. If not provided they just return the response from GET
• If you already have PUT/DELETE endpoints, why not make them accessible to the url creator? you could store some extra Uuid (auth token) per created short url and return it on the initial POST request. Then the delete could look like DELETE /api/urls/{TOKEN}/{AUTH_TOKEN}. Just make sure its long enough to not randomly guess or bruteforce before hitting your spam protection.