diff --git a/server/AyaNova/Controllers/AttachmentController.cs b/server/AyaNova/Controllers/AttachmentController.cs
index d3eea69e..6e74ae7f 100644
--- a/server/AyaNova/Controllers/AttachmentController.cs
+++ b/server/AyaNova/Controllers/AttachmentController.cs
@@ -70,6 +70,7 @@ namespace AyaNova.Api.Controllers
         /// <param name="id"></param>
         /// <param name="inObj"></param>
         /// <returns>list</returns>
+        [Authorize]
         [HttpPut("{id}")]
         public async Task<IActionResult> PutAttachment([FromRoute] long id, [FromBody] UpdateAttachmentInfo inObj)
         {
@@ -146,6 +147,7 @@ namespace AyaNova.Api.Controllers
         /// 
         /// </summary>        
         /// <returns>file attachment list for object</returns>
+        [Authorize]
         [HttpGet("List")]
         public async Task<IActionResult> GetList([FromQuery] AyaType ayaType, [FromQuery] long ayaId)
         {
@@ -432,7 +434,6 @@ namespace AyaNova.Api.Controllers
                 return StatusCode(401, new ApiErrorResponse(ApiErrorCode.AUTHENTICATION_FAILED));
             }
 
-            //TODO: EVENT LOG THIS SHIT
 
             var utcNow = new DateTimeOffset(DateTime.Now.ToUniversalTime(), TimeSpan.Zero);
             if (DownloadUser.DlKeyExpire < utcNow.DateTime)