Require auth on an open API endpoint

broken-access

An API endpoint returns data with no authentication at all, so anyone who guesses the URL reads it. Put the check on the route, not on the UI.

Your stack

Next.js

1 Add authentication checks to your API routes and middleware

typescript

// middleware.ts
export function middleware(request) {
  const session = getToken({ req: request });
  if (!session && request.nextUrl.pathname.startsWith('/api/')) {
    return new Response('Unauthorized', { status: 401 });
  }
}

Express

1 Add authentication middleware to all API routes that handle sensitive data

javascript

// Protect all /api routes
app.use('/api', authMiddleware);

function authMiddleware(req, res, next) {
  if (!req.session?.userId) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  next();
}

Spring Boot

1 Configure endpoint authorization in your SecurityFilterChain

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/api/**").authenticated()
        .anyRequest().permitAll()
    );
    return http.build();
}

Does your app still have this?

Scan your domain