Authorization check may be missing

Investigates authenticated handlers that may not authorize access to the requested resource.

Detail	Value
Check ID	`MISSING_AUTHORIZATION_CHECK`
Severity	High
How it runs	Agent review

Anchor to Vulnerable exampleVulnerable example

import type { ActionFunctionArgs } from "react-router";

import { authenticate } from "../shopify.server";

import prisma from "../db.server";

export const action = async ({ request, params }: ActionFunctionArgs) => {

// Authentication answers "who is calling". It doesn't answer

// "may this caller delete this record".

await authenticate.admin(request);

await prisma.report.delete({ where: { id: params.id } });

return { deleted: true };

};

Authorize the actor and resource after authentication.

import type { ActionFunctionArgs } from "react-router";

import { authenticate } from "../shopify.server";

import prisma from "../db.server";

export const action = async ({ request, params }: ActionFunctionArgs) => {

const { session } = await authenticate.admin(request);

// Authorize the actor against the resource, then act on the

// record you just authorized rather than on the raw id.

const report = await prisma.report.findFirst({

where: { id: params.id, shop: session.shop },

});

if (!report) throw new Response("Not found", { status: 404 });

await prisma.report.delete({ where: { id: report.id } });

return { deleted: true };

};

Was this page helpful?