Fix Authentication Bypass with AI Prompts

Audit my codebase for authentication bypass vulnerabilities.

Framework: Next.js/Express/FastAPI/Django

Check for:

1. API routes without auth middleware
2. Pages without session checks
3. Server actions without auth verification
4. GraphQL resolvers without auth
5. Webhook endpoints with weak/no validation

List all routes and their auth status:

• Route path
• HTTP method
• Auth required? (yes/no)
• Current protection (middleware, inline check, none)
• Sensitivity level (public, user, admin)

Flag any routes that:

• Handle sensitive data without auth
• Rely only on client-side auth checks
• Have inconsistent auth between similar routes

Add proper server-side authentication to these routes.

Routes needing auth: list your routes

For each route:

1. Verify session/token on the server
2. Check user exists and is active
3. Verify required permissions/roles
4. Return 401 for no auth, 403 for no permission
5. Log unauthorized access attempts

Avoid these mistakes:

• Trusting client-sent user IDs
• Only checking auth on frontend
• Using predictable/guessable tokens
• Not validating token signature

Show middleware pattern I can reuse across routes.

Fix IDOR vulnerabilities where users can access other users' data.

Current issue: Users can access /api/user/id with any ID

Fix by adding authorization checks:

1. Verify authenticated user owns the resource
2. Or verify user has admin permissions
3. Return 404 (not 403) to avoid leaking existence

Review these patterns:

• /api/users/id - user profile
• /api/orders/id - order details
• /api/documents/id - document access
• /api/settings/id - user settings

For each:

• Add ownership check
• Use session user ID, not request parameter
• Consider using UUIDs instead of sequential IDs
• Add query scoping: WHERE user_id = currentUser.id

Review and fix my JWT authentication for bypass vulnerabilities.

Check for these issues:

1. Algorithm confusion (accepting "none" or HS256 when expecting RS256)
2. Missing signature verification
3. Not checking expiration (exp claim)
4. Trusting user-provided claims without verification
5. Weak or hardcoded secrets

Fix implementation to:

• Explicitly specify allowed algorithms
• Verify signature with correct key
• Check exp and nbf claims
• Validate issuer (iss) and audience (aud)
• Reject tokens missing required claims

Also implement:

• Token refresh flow
• Revocation checking (if needed)
• Proper error responses