add comment

Author: tlrx

server/src/main/java/org/elasticsearch/rest/action/cat/RestIndicesAction.java

@@ -132,6 +132,14 @@ public void onFailure(final Exception e) {
         };
     }
 
+    /**
+     * We're using the Get Settings API here to resolve the authorized indices for the user.
+     * This is because the Cluster State and Cluster Health APIs do not filter output based
+     * on index privileges, so they can't be used to determine which indices are authorized
+     * or not. On top of this, the Indices Stats API cannot be used either to resolve indices
+     * as it does not provide information for all existing indices (for example recovering
+     * indices or non replicated closed indices are not reported in indices stats response).
+     */
     private void sendGetSettingsRequest(final String[] indices,
                                         final IndicesOptions indicesOptions,
                                         final boolean local,