Route handler lacks recognized auth verification
Detects a backend route that reads or writes shop data without verifying the request first.
The deterministic scan recognizes the app template's route-auth shape: an awaited authenticate.* call before the protected operation. A route that authenticates through context.shopify.authenticate.admin is handed to agent review rather than reported as missing authentication, because the scan can't tell from the spelling alone whether that call is awaited, genuine, and blocking.
| Detail | Value |
|---|---|
| Check ID | UNAUTHENTICATED_ENDPOINT |
| Severity | High |
| How it runs | Deterministic scan and agent review |
| Applies to | Apps with a backend |
Anchor to Vulnerable exampleVulnerable example
app/routes/app.orders.tsx
import type { LoaderFunctionArgs } from "react-router";
import prisma from "../db.server";
// No authentication barrier: anyone who can reach the route
// reads the table.
export const loader = async ({ request }: LoaderFunctionArgs) => {
const url = new URL(request.url);
return {
orders: await prisma.order.findMany({
where: { shop: url.searchParams.get("shop") ?? undefined },
}),
};
};
Anchor to How to fixHow to fix
Complete the verification appropriate to the entry point before protected operations, and stop those operations when verification fails.
For more detail, see Authentication and authorization.
app/routes/app.orders.tsx
import type { LoaderFunctionArgs } from "react-router";
import { authenticate } from "../shopify.server";
import prisma from "../db.server";
export const loader = async ({ request }: LoaderFunctionArgs) => {
// Await the barrier before touching any shop data. An un-awaited
// authenticate.admin(request) is still flagged: the query races
// it.
const { session } = await authenticate.admin(request);
return {
orders: await prisma.order.findMany({ where: { shop: session.shop } }),
};
};
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?