Missing Authentication Middleware

Why it matters

Without authentication middleware, anyone can access your API endpoints. An attacker can read, modify, or delete data without proving their identity. AI tools often scaffold routes without auth because they generate one handler at a time and forget the bigger security picture.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

const express = require('express');
const app = express();
app.get('/api/users', (req, res) => {
  res.json(users);
});
app.post('/api/data', (req, res) => {
  res.json({ ok: true });
});

The smallest fix

// Add auth middleware to routes:
app.get('/api/users', authMiddleware, handler);
// Or apply to all routes:
app.use('/api', authMiddleware);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Attempt to access protected endpoints without auth token — expect 401
2. Access with valid token — expect 200
3. Verify auth middleware is applied before route handlers

Further reading

• https://cwe.mitre.org/data/definitions/306.html
• https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/