---
title: Authorization check may be missing
description: >-
  Investigates authenticated handlers that may not authorize access to the
  requested resource.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-authorization-check
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-authorization-check.md
---

# Authorization check may be missing

Investigates authenticated handlers that may not authorize access to the requested resource.

| Detail | Value |
| - | - |
| Check ID | `MISSING_AUTHORIZATION_CHECK` |
| Severity | High |
| How it runs | Agent review |

***

## Vulnerable example

## app/routes/app.reports.$id.delete.tsx

```tsx
import type { ActionFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const action = async ({ request, params }: ActionFunctionArgs) => {
  // Authentication answers "who is calling". It doesn't answer
  // "may this caller delete this record".
  await authenticate.admin(request);


  await prisma.report.delete({ where: { id: params.id } });


  return { deleted: true };
};
```

***

## How to fix

Authorize the actor and resource after authentication.

## app/routes/app.reports.$id.delete.tsx

```tsx
import type { ActionFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const action = async ({ request, params }: ActionFunctionArgs) => {
  const { session } = await authenticate.admin(request);


  // Authorize the actor against the resource, then act on the
  // record you just authorized rather than on the raw id.
  const report = await prisma.report.findFirst({
    where: { id: params.id, shop: session.shop },
  });


  if (!report) throw new Response("Not found", { status: 404 });


  await prisma.report.delete({ where: { id: report.id } });


  return { deleted: true };
};
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***