API route without an access check
Scan rule · RSC-SEC-059
- Security
- Severity: High
- CWE-862
- OWASP A01-2021
Finds route handlers with mutating methods that contain no authentication.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Verify the session server-side and answer 401 without a valid identity.