How to disable/restrict a certain url

[tungpx]

Hello,

In my Splunk web service, we have the domain, for example: https://splunksh.com 

The problems is anyone can get access to https://splunksh.com/config without login. Although the page doesn't contain any sensitive data, our Cyber Security team deem it as a vulnability that need to be fix. I want to know how to either disable that url, or redirect it to the login page. Any help would be very apriciate. 

[gcusello]

Hi @tungpx ,

let me understand: you have a Splunk instance accessible without login (also by API)?

is it maybe a free Splunk instance? in this case the only solution is to buy a license.

Could you better describe your situation?

Ciao.

Giuseppe

[tungpx]

I do have Splunk Enterprise license and my Splunk version is 9.1.1. 

The problem I have is anyone can access this url htttps:...../en-US/config and it will show up even if the user is login or not, like so