Secure internal-backstage endpoints

[chriswk]

Describe the feature request

I would like Edge to hide internal-backstage endpoints by default (except health/ready).

Background

Currently we expose quite a few details in our /internal-backstage urls
/internal-backstage/metrics
/internal-backstage/features
/internal-backstage/tokens
/internal-backstage/metricsbatch

In Unleash's loadbalanced setup, we always block public access to URLs containing /internal-backstage. But not all users of Edge will have our loadbalancer setup.

Solution suggestions

I'd like us to by default not mount the internal-backstage endpoints.

Preferably we'd have a way to setup basic auth for the internal-backstage endpoints, or alternately (for Unleash's sake) a switch turning them all on.

[aat2703]

Thanks for opening the issue 👍

[chriswk]

So, as a work around for now, in 19.6.1 each endpoint has a toggle to turn it off.