Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
Using Drupal 8. I have 3 types of content that I need to display: Public, Authenticated, Role-Based (and Admin only) With views, restrictions are straight-forward, however, users are able to EASILY bypass security by accessing nodes directly! /node/N
First, am I missing a simple configuration setting? If not, how is it possible that this isn't deemed a security risk of the highest order?
It's really annoying seeing that D8 isn't production ready, yet it's the default on the api site.
I haven't lost a ton of time reviewing the site, but it's been enough to be really annoying to not find the correct hook documentation and then realizing I'm on the wrong version.
Seeing as most production sites are on D7, and most devs are researching that version, it would make more sense to keep that the default version of the api site.