missing-authentication-anti-pattern

name	missing-authentication-anti-pattern
description	Security anti-pattern for missing or broken authentication (CWE-287). Use when generating or reviewing code for login systems, API endpoints, protected routes, or access control. Detects unprotected endpoints, weak password policies, and missing rate limiting on authentication.

Missing Authentication Anti-Pattern

Severity: Critical

Summary

Missing or broken authentication occurs when applications fail to verify user identity, allowing unauthorized access to protected data and functionality. This manifests as unprotected endpoints, missing session checks, or weak credential verification vulnerable to bypass or brute-force. AI-generated code frequently produces insecure boilerplate with stubbed or missing authentication checks.

The Anti-Pattern

Never create endpoints accessing sensitive data or functionality without verifying user identity and validating active sessions.

BAD Code Example

# VULNERABLE: Critical API endpoint without authentication check
from flask import request, jsonify
from db import User, session

@app.route("/api/users/<int:user_id>/profile")
def get_user_profile(user_id):
    # Takes user ID and returns profile data
    # CRITICAL FLAW: Never checks who makes the request
    # Any user can access any profile by changing user_id in URL
    user = session.query(User).filter_by(id=user_id).first()

    if  user:
         jsonify({: }), 

    
     jsonify({
        : user.,
        : user.username,
        : user.email,
        : user.created_at
    })