I own a set of REST APIs and some of them don't require users to be authenticated.
Example could be:
api/items/index of an e-commerce".
Currently, I use Cookie-based tokens from my application, but only for secured API like edition of an item:
api/items/2/edit for instance.
What could prevent anybody to track from its own application the corresponding direct URL (let's say
https://myAppDomain/api/items/index and got all the items as a pure list of JSON?
Indeed, it could be lead to phishing...