no-missing-authentication

Keywords: no-missing-authentication, Express, Fastify, route handler, middleware, JWT, security, ESLint rule, CWE-287, broken authentication CWE: CWE-287: Improper Authentication
OWASP Mobile: OWASP Mobile Top 10 M3: Insecure Communication

CWE: CWE-287

ESLint Rule: no-missing-authentication. This rule is part of eslint-plugin-secure-coding.

Quick Summary

Vulnerability and Risk

Vulnerability: Missing authentication checks on sensitive API routes. This occurs when an endpoint that should be restricted is exposed to unauthenticated (anonymous) users.

Risk: Attackers can access private data, perform actions on behalf of other users, or gain administrative control over the application. Broken authentication is one of the most common and impactful security vulnerabilities in modern web applications.

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-287 OWASP:M3 | Missing Authentication detected | CRITICAL [BrokenAuth]
   Fix: Add authentication middleware (e.g., authenticate()) to this route | https://cwe.mitre.org/data/definitions/287.html

Message Components

Rule Details

This rule scans route handlers in popular frameworks (Express, Fastify, etc.) and flags those that do not include a recognized authentication middleware in their middleware chain.

Why This Matters

Configuration

This rule supports extensive configuration to match your project's middleware naming conventions:

{
  "rules": {
    "secure-coding/no-missing-authentication": ["error", {
      "authMiddlewarePatterns": ["authenticate", "requireAuth", "passport.authenticate"],
      "routeHandlerPatterns": ["get", "post", "put", "delete"],
      "ignorePatterns": ["/api/public/*"]
    }]
  }
}

Examples

❌ Incorrect

// Express route without any authentication middleware
app.get('/api/user/profile', (req, res) => {
  // ❌ VULNERABLE: Direct access to profile data
  res.json(req.user.profile);
});

// Fastify route missing protection
fastify.post('/api/settings', async (request, reply) => {
  // ❌ VULNERABLE: Anyone can change settings
  updateSettings(request.body);
});

✅ Correct

// Using recognized authentication middleware (Express)
app.get('/api/user/profile', authenticate(), (req, res) => {
  // ✅ SECURE
  res.json(req.user.profile);
});

// Using Passport.js
app.post(
  '/api/settings',
  passport.authenticate('jwt', { session: false }),
  (req, res) => {
    // ✅ SECURE
    updateSettings(req.body);
  },
);

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Global Middleware

Why: If authentication is applied globally via app.use(authMiddleware), this rule might still flag individual routes because it doesn't always see the global application setup.

Mitigation: Use // eslint-disable-next-line on individual routes if global protection is active, or configure the rule to ignore specific files.

Custom Logic Checks

Why: If you perform authentication inside the handler function body using imperative logic instead of middleware.

app.get('/data', (req, res) => {
  if (!req.user) return res.status(401).send(); // ❌ Rule may not see this
  ...
});

Mitigation: Always prefer middleware for authentication to ensure it runs before any business logic and is easily audited.

References

• CWE-287: Improper Authentication
• OWASP Authentication Cheat Sheet
• Express Guide - Using Middleware