Unauthenticated or Unguarded State-Mutating Boundary Endpoint

Remediation checklist

• TypeScript & JavaScript: enforce session/principal verification, rate limiting, and CSRF/challenge validation at the top of every exported Next.js 'use server' action and mutating Express/Fastify/Hono route; Go: wrap mutating HTTP/gRPC handlers in explicit authentication and rate-limit middleware.
• Python: attach Depends(require_user), @login_required, or IsAuthenticated permission classes on mutating FastAPI/Flask/Django views; Java & Kotlin: enforce @PreAuthorize/@Secured on Spring @PostMapping/@DeleteMapping controllers and authenticate {} blocks on Ktor routes.
• C#: require [Authorize] or RequireAuthorization() (and never [AllowAnonymous] without compensating proof) on mutating ASP.NET Core actions; Rust & C/C++: require authenticated principal extractors/middleware (Axum/Actix) or verified mTLS/token guards on mutating RPC handlers.
• Ruby: never bypass before_action :authenticate_user! or verify_authenticity_token on mutating Rails controller actions, and enforce Pundit/CanCanCan authorization; PHP: attach auth middleware + Gate::authorize / #[IsGranted] on Laravel/Symfony routes and real capability checks (never '__return_true') on mutating WordPress register_rest_route endpoints; Swift: protect mutating Vapor routes with AuthMiddleware and req.auth.require(User.self).

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// TypeScript Next.js Server Action without auth or rate limit
"use server";
export async function deleteTenant(tenantId: string) {
  return await db.tenants.delete(tenantId);
}

# Ruby on Rails: skipping auth on mutating destroy action
class UsersController < ApplicationController
  skip_before_action :authenticate_user!, only: [:destroy]
  def destroy; User.find(params[:id]).destroy!; end
end

// TypeScript Next.js Server Action with rate limit + session guard
"use server";
export async function deleteTenant(tenantId: string) {
  await consumeSubmissionRateLimit("delete-tenant");
  const session = await requireAuthenticatedSession();
  await authorizeTenantAdmin(session.userId, tenantId);
  return await db.tenants.delete(tenantId);
}