Protect rest backend when no query is provided