Missing Authorization (ARCH5120)

Key go.security.missing-authorization · Severity warning · Category security · CWE CWE-862

A Go router has no annotation to read, so the check is by file: POST/PUT/DELETE/PATCH routes (gin, echo, fiber, chi, gorilla/mux) registered in a file where nothing auth-shaped appears - no middleware, identifier or import naming auth, JWT, session, guard or roles - are flagged once each. A file that does mention one is trusted.

Incorrect

func routes(r *gin.Engine) {
  r.GET("/users", list)
  r.POST("/users", create)
  r.DELETE("/users/:id", remove)
}

Correct

func routes(r *gin.Engine) {
  r.GET("/users", list)
  protected := r.Group("/", RequireAuth())
  protected.POST("/users", create)
  protected.DELETE("/users/:id", remove)
}

Fix

Register mutating routes on a group behind an authentication middleware and check the caller’s permission in the handler.