API Endpoints Without Authentication Checks
What Is This Vulnerability?
Missing authentication occurs when API endpoints or application routes are accessible without requiring any form of identity verification. This allows anonymous users or automated bots to access, modify, or delete data that should be restricted to authenticated users, potentially exposing the entire application's data layer.
Why It Happens
Developers sometimes forget to apply authentication middleware to new endpoints, especially during rapid development. Internal APIs originally intended for server-to-server communication get exposed publicly. Route-level middleware is missed when frameworks require explicit per-route application rather than global enforcement.
Example Code
app.get("/api/users", async (req, res) => {
const users = await db.query("SELECT * FROM users");
res.json(users.rows);
});
app.delete("/api/users/:id", async (req, res) => {
await db.query("DELETE FROM users WHERE id = $1", [req.params.id]);
res.json({ deleted: true });
});import { requireAuth } from "@/middleware/auth";
app.get("/api/users", requireAuth, async (req, res) => {
const users = await db.query("SELECT * FROM users");
res.json(users.rows);
});
app.delete("/api/users/:id", requireAuth, async (req, res) => {
if (req.user.role !== "admin") {
return res.status(403).json({ error: "Forbidden" });
}
await db.query("DELETE FROM users WHERE id = $1", [req.params.id]);
res.json({ deleted: true });
});How Hackers Exploit It
Attackers use automated tools to scan for unprotected endpoints by testing common API paths (/api/users, /api/admin, /api/config). They enumerate routes using wordlists and check for responses that return data without requiring authentication headers. Once found, they can extract sensitive data, modify records, or escalate to admin operations.
How to Fix It
Apply authentication middleware globally and explicitly opt out only for public routes. Use a framework pattern where all routes are protected by default. Regularly audit your route definitions to ensure every endpoint has appropriate authentication. Implement integration tests that verify protected endpoints return 401 when called without credentials.