highLogins, sessions and access

Route Changes Data Without Checking Who Is Asking

An endpoint that changes data does not check that the caller is signed in.

Why it matters

Front-end code hides the button, but the URL still exists and anyone can call it with curl. The framework already knows who the current user is; the route just has to ask before it writes.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Flask POST route with no auth anywhere in the file
@app.route('/posts', methods=['POST'])
def create_post():
    post = Post(title=request.json['title'])
    db.session.add(post)
    db.session.commit()
    return jsonify(post.to_dict()), 201

The smallest fix

minimal patch
# Flask-Login
@app.route('/posts', methods=['POST'])
@login_required
def create_post():
    ...
# FastAPI
@router.post('/posts')
def create_post(body: PostIn, user: User = Depends(get_current_user)):
    ...

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
# Put the check in one place: a Flask before_request hook on the
# blueprint, or a FastAPI router-level dependency
# (APIRouter(dependencies=[Depends(get_current_user)])), so a new route
# cannot forget it.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a route that changes data has no authentication: [the flagged code]. Add the app's login check (Flask-Login's login_required, a JWT check, or a FastAPI dependency that returns the current user), and where a record belongs to a user, filter by that user's id as well. If this endpoint is meant to be public, say so in a comment above it.

How to check the fix worked

1. Call the endpoint with no session or token and confirm a 401.
2. Call it as user A against user B's record and confirm a 403 or 404.
3. Call it correctly and confirm it still works.

Further reading