[FLI-788] Docs: Clearer example for securing management backend about flipt

[GeorgeMac]

Cheers for the issue @giddel !

I think we might need to consider removing the option to disable auth on the management/metadata sections of the API. Unless we can find a solution to the redirection behavior.

It’s worth us considering removing the ability to make these paths unprotected as I’m unsure if there are any valid use cases for allowing unauthenticated actors to change or read flag state when e.g. other actors need auth to perform an evaluation.

The original motivation for the exclusions was really to support just exposing evaluation without authentication. Maybe we went a bit too far.

I think we’re free to remove this capability too if it has never worked. It’s not going to break anyone’s compatibility.

[giddel]

😸

[GeorgeMac]

We removed the ability for metadata to be excluded in the latest version of Flipt.
It is marked deprecated, but is just a noop lever.