I'm using Bitnami CouchDB on Google Cloud, installed via Google cloud deployment.
It's a standard install, and there's an admin password to fix the "admin party".
Problem is, attempting to access alldbs when not logged on is producing a list of all the databases, which is a huge security hole and has been the subject of much discussion in CouchDB circles. Accessing alldbs should fail unless a session has been properly logged on.
In desperation, I've tried SSL (same deal), and even tried editing local.ini to remove the alldbs handler from httpd_global_handlers. Restart, reload config via Fauxton, verify setting has changed ... but the server still responds to alldbs.
Any suggestions or workarounds gratefully received