why? service deny policy in ACL rule of anonymous ineffective

[bomee]

server and client both are 0.7.5

service "" {
  policy="deny"
}

curl http://host:8500/v1/catalog/services?token=anonymous
anonymous user still view all services info, isn't not safety?

[slackpad]

Hi - we'd need more details about your configuration to figure out what's going on.

[bomee]

I have read source code find

func (f *aclFilter) allowService(service string) bool {
	if service == "" || service == ConsulServiceID {
		return true
	}
	return f.acl.ServiceRead(service)
}

a magic code service == ConsulServiceID.What is the intention of this code?

[slackpad]

The Consul servers do the registration for that server on behalf of the cluster, so it was excluded from ACLs. That exception should be removed when enforceVersion8 is set, though, so I'll remove it.