Missing authorization (ARCH3120)

Key typescript.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Exposing sensitive actions without an authentication/authorization guard lets anyone reach protected resources. Apply an authorization check to every sensitive route.

Incorrect

app.delete("/admin/users/:id", async (req, res) => {
  await User.destroy({ where: { id: req.params.id } });
  res.sendStatus(204);
});

Correct

app.delete("/admin/users/:id", requireRole("admin"), async (req, res) => {
  await User.destroy({ where: { id: req.params.id } });
  res.sendStatus(204);
});

Fix

Add authentication and role/ownership-based authorization middleware to every protected route.