highLogins, sessions and access

NestJS Handler Changes Data Without a Guard

A route that changes data does not check that the caller is signed in.

Why it matters

NestJS runs no authentication unless a guard says so. Front-end code hides the button, but the URL still exists and anyone can call it with curl. The guard is one decorator, and registering it globally means a new controller cannot forget it.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Controller with a POST and no guard
import { Controller, Post, Body } from '@nestjs/common';

@Controller('posts')
export class PostsController {
  constructor(private readonly posts: PostsService) {}

  @Post()
  create(@Body() dto: CreatePostDto) {
    return this.posts.create(dto);
  }
}

The smallest fix

minimal patch
@Controller('posts')
@UseGuards(JwtAuthGuard)
export class PostsController {
  @Post()
  create(@Body() dto: CreatePostDto, @Req() req) { ... }
}

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Register the guard once for the whole app and opt public routes out
// with a @Public() decorator that the guard checks via Reflector:
providers: [{ provide: APP_GUARD, useClass: JwtAuthGuard }]

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a handler that changes data has no guard: [the flagged code]. Add @UseGuards(JwtAuthGuard) to the controller (or register the guard globally with APP_GUARD and mark genuinely public routes with a @Public() decorator). Where a record belongs to a user, filter by the caller's id from the request as well.

How to check the fix worked

1. Call the endpoint with no token and confirm a 401.
2. Call it as user A against user B's record and confirm a 403 or 404.
3. Call it correctly and confirm it still works.

Further reading