There is a reason I'm asking this and let me create a simple scenario where I find this information relevant:
You have server A which publishes REST services. Server A only allows server B to access it (ip whitelist and such). Server B calls REST services from server A. These REST calls are unsecured and do not require authentication because only server B can call those rest services.
- Can a user see the rest calls the Angular website makes?
- If yes, can a user abuse these unsecured REST calls somehow?