On any given Magento2 website, you can navigate to https://yourmagentostore.com/swagger and access the swagger UI for API methods.
One of the methods that you can test before being authenticated is getting a token. You get that by using the
All that method needs is the admin username and password.
To me this seems like a security risk. Any bot can brute Force this form to try and guess the admin credentials. So even if you created a complicated path to your admin route, here's an easy place for someone else to try and guess it.
Am I missing something? Are you supposed to disable swagger for your production environment?
While I'm at it, I guess you don't need the swagger UI, anyone can just brute Force the API
integrationAdminTokenService to try and get the user credentials.
Does Magento2 have any measures in place to prevent such attacks?