sast-missingauth

Missing Authentication & Broken Function-Level Authorization Detection

You are performing a focused security assessment to find missing authentication and broken function-level authorization vulnerabilities in a codebase. This skill uses a two-phase approach with subagents: recon (map endpoints and the permission system) then verify (check every endpoint for proper auth/authz gates).

Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.

---

What This Skill Covers

Missing Authentication

An endpoint performs a sensitive action but requires no login at all — any anonymous HTTP request can trigger it.

Broken Function-Level Authorization

An endpoint requires authentication (user must be logged in) but does not check whether the authenticated user has the required role or permission to invoke that function. The classic example: a regular user calling an admin-only API.

What This Skill Is NOT

Do not conflate with:

• IDOR / Horizontal privilege escalation: Authenticated user A accessing user B's resource by changing an ID. This skill covers vertical privilege escalation and unauthenticated access.
• JWT weaknesses: Flawed token signing/verification (covered by sast-jwt).
• Business logic flaws: Price manipulation, workflow bypass — these are separate.

---

Vulnerability Classes

Class 1: Unauthenticated Sensitive Endpoint

The endpoint modifies data, returns private information, or performs an administrative action — with no authentication required.

GET /api/admin/users          → returns full user list, no token needed
DELETE /api/admin/users/5     → deletes a user, no token needed
POST /api/settings/smtp       → updates server config, no token needed

Class 2: Authenticated but Missing Role Check

The endpoint requires a valid session/token but performs no role or permission check. Any authenticated user — regardless of role — can invoke admin or privileged functions.