Stop 18 of 42 · Account Access · Routes without authentication

The service window nobody guards

The bank has a guard at the main counter who checks every badge. But years ago someone opened a side counter for “exports,” and no one ever posted a guard there. A robber without any badge simply walks up and asks for everything.

Severity Medium–CriticalCategory Auth WeaknessAccount AccessSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory has no badge. The guard stops her at the main counter, but the forgotten side counter has no guard and hands her every account.

Arrival

Mallory walks into the bank with no badge at all. Anyone can enter the lobby.

Mallory says: One statement, please.
1 / 5

In bank terms and app terms

In the bankIn your app
Service windowAn API route or Server Action (/api/export, a "use server" function)
Badge check at the windowCalling getUser, getSession, auth() or similar at the top of the route
Forgotten side counterA route added later, or for testing, that never got the auth call
Counters that are meant to be openHealth checks and public docs, which are the only ones that should skip it

Are you exposed?

You might be exposed if…
  • Some of your API routes or Server Actions never call an auth function before touching data.
  • You protect pages in the UI, but the API behind them can be called directly with curl.
  • Login is only checked in the front end, or in some routes but not the ones added last month.
What to do about it
  1. Require a verified session at the top of every route and Server Action, and fail with 401 if there is none.
  2. Make “protected” the default (a shared wrapper or middleware) and mark public routes explicitly.
  3. Call your own routes with no token as a test; anything that returns data should be a surprise.

Track these in your to-do list →

It has happened to real companies

Real-world breaches

Optus Australia (2022) — The Australian regulator ACMA alleges a coding error left the access controls on an Optus API ineffective, so attackers could pull customer data through it by trial and error. The privacy regulator (OAIC) says about 9.5 million Australians were affected, with data that included passport and driver's licence numbers. These are allegations made by the regulators.

Peloton (2021) — API endpoints lacked authentication, allowing anyone to query user account data (age, gender, city, weight) for any Peloton user without logging in.

What it looks like in code

// BAD: No auth check — anyone can list all users
export async function GET() {
  const users = await db.select().from(profiles)
  return NextResponse.json(users)
}

// BAD: Auth on the page but not the API route
// src/app/dashboard/page.tsx → has auth check
// src/app/api/tasks/route.ts → no auth check (accessible directly)

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
List every API route, Next.js route handler and Server Action in this project. For each one, tell me whether it verifies the caller’s session before doing anything. Add a shared auth guard to the ones that do not (return 401 when there is no valid session), and leave only health checks and docs public. Show me the list of routes you changed.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.