Every API Route Checks Permissions

A single unprotected API route or Server Action is a complete authorization bypass for any operation it performs. API routes in Next.js are public endpoints by default — authentication and authorization must be added explicitly. CWE-285 (Improper Authorization) and CWE-284 (Improper Access Control) are both in play when a route performs database writes without verifying who is asking. OWASP A01 (Broken Access Control) is the top web application risk category for this exact reason. NIST 800-53 AC-3 and AC-6 require access enforcement before any privileged operation executes. Server Actions receive the same treatment — they are callable from the browser and must not assume caller identity.

Every route handler that touches the database must begin with a session check. Treat every route as a public endpoint and require explicit proof of authorization before acting.

// app/api/posts/route.ts
import { auth } from '@/lib/auth';

export async function GET(req: NextRequest) {
  const session = await auth();
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  // Now safe to query
  const posts = await db.post.findMany({ where: { userId: session.user.id } });
  return NextResponse.json(posts);
}

After fixing, audit completeness by grepping for database operations (.findMany, .create, .update, .delete) and confirming every one is preceded by a session check in its call chain.