diff --git a/changelog/unreleased/refactor-proxy.md b/changelog/unreleased/refactor-proxy.md
new file mode 100644
index 0000000000..1a0c222112
--- /dev/null
+++ b/changelog/unreleased/refactor-proxy.md
@@ -0,0 +1,6 @@
+Enhancement: Refactor the proxy service
+
+The routes of the proxy service now have a "unprotected" flag. This is used by the authentication middleware to determine if the request needs to be blocked when missing authentication or not. 
+
+https://github.com/owncloud/ocis/issues/4401
+https://github.com/owncloud/ocis/pull/4461
diff --git a/services/proxy/pkg/config/defaults/defaultconfig.go b/services/proxy/pkg/config/defaults/defaultconfig.go
index 97efdb9841..05740a72ef 100644
--- a/services/proxy/pkg/config/defaults/defaultconfig.go
+++ b/services/proxy/pkg/config/defaults/defaultconfig.go
@@ -174,9 +174,13 @@ func DefaultPolicies() []config.Policy {
 					Unprotected: true,
 				},
 				{
-					Endpoint:    "/app/", // /app or /apps? ocdav only handles /apps
+					Endpoint:    "/app/list",
 					Backend:     "http://localhost:9140",
-					Unprotected: true, // TODO check if this is safe
+					Unprotected: true,
+				},
+				{
+					Endpoint: "/app/", // /app or /apps? ocdav only handles /apps
+					Backend:  "http://localhost:9140",
 				},
 				{
 					Endpoint: "/graph/",