authz-check
Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
Datos de origen
- Repositorio
- Archive228/loopkit
- Última actividad en el origen
- 29 de junio de 2026 a las 22:25
- Idioma detectado de SKILL.md
- inglés
- Estrellas
- 757
- Forks
- 124
Opciones de instalación
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Revisa los archivos de origen
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Mostrando SKILL.md
SKILL.md
Instrucciones de origen · Vista previa de solo lectura- name
- authz-check
- description
- Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
- when_to_use
- new/changed endpoint, "get user X's data", a mutation, an admin action
# Authz Check
The most common security hole: the code checks you're logged IN, but not that you OWN the thing.
- For every resource access: does it verify the current user is allowed THIS specific record? `WHERE id = ? AND owner_id = current_user` — not just `WHERE id = ?`.
- IDOR test: swap the ID in the request to another user's. Does it leak/allow?
- Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
- Default deny: new endpoints should require explicit authorization, not be open by oversight.
Output each handler that authenticates but doesn't authorize, with the missing check.
Ver en GitHub