Missing Authorization (ARCH9120)

Key swift.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Flags Vapor state-changing routes (post / put / delete / patch) registered directly on the application with no authenticator or guard middleware in the file.

Incorrect

app.delete("users", ":id") { req in ... }

Correct

let protected = app.grouped(UserToken.authenticator(), User.guardMiddleware())
protected.delete("users", ":id") { ... }

Fix

Register mutating routes on a group behind an authenticator and guard middleware.