🔐 Enforce authentication on sensitive backend controller endpoints #62
Description
🔐 Security Issue: Missing Authentication Enforcement on Sensitive Backend Endpoints.
📌 Description :
Several backend controller endpoints handle sensitive operations such as recording uploads, rendering jobs, streaming control, and email invitations without explicitly enforcing authentication checks.
While some routes may rely on upstream middleware, the controllers themselves assume the presence of req.user without validating it. This creates a fragile setup where misconfiguration or reuse of routes could allow unauthenticated access to protected functionality.
📂 Affected Areas :
The following backend controllers expose endpoints that should explicitly require authentication:
- backend/recording/recording.controller.js
- backend/controllers/renderController.js
- backend/controllers/emailController.js
- backend/controllers/youtubeController.js
🔎 Example (Current Behavior) :
-
Some backend controllers assume authentication without explicitly enforcing it.
-
Example: backend/controllers/renderController.js
export const startRender = async (req, res) => {
const { sessionId, layout, inputs, duration } = req.body;
// No explicit authentication check
const result = await renderComposition({
sessionId,
layout,
inputs,
duration
});
res.json({
success: true,
downloadUrl: result.url
});
};
❌ If authentication middleware is misconfigured or bypassed, this endpoint can be called without a valid user session, triggering expensive render jobs.
❗ Problem
- No explicit verification of req.user
- Sensitive endpoints can be accessed if authentication middleware is bypassed or misapplied
- Increases the risk of unauthorized usage of system resources
✅ Expected Behavior
- All protected endpoints should explicitly enforce authentication
- Requests without valid authentication should return:
- 401 Unauthorized or
- 403 Forbidden
- Authentication enforcement should be consistent across controllers
🛠️ Proposed Solution
👍 Add explicit authentication checks (req.user) inside controllers or Apply a shared authentication middleware to all sensitive routes
💯 This improves:
-
- Security (defense in depth)
-
- Code reliability
-
- Maintainability
🚨 Security Impact
- Severity: High❌❌🚫
- Category: Backend Security / Access Control
- OWASP Reference: A01 – Broken Access Control