T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:357- Finding
Authentication Bypass Through Unverified Session Cookie
- Content
View full analysis
pathname.startsWith(route))) { // Redirect authenticated users away from auth pages if (token && authRoutes.some(route => pathname.startsWith(route))) { return NextResponse.redirect(new URL('/dashboard', request.url)) } return NextResponse.next() } // Protected routes — require auth if (!token) { const loginUrl = new URL('/login', request.url) loginUrl.searchParams.set('callbackUrl', pathname) return NextResponse.redirect(loginUrl) } return NextResponse.next() } ``` ### Technical Analysis The middleware considers a request authenticated whenever the `session` cookie contains any non-empty value. It does not cryptographically verify the cookie, resolve it against a trusted server-side session store, or validate properties such as expiration, revocation status, issuer, or audience. Cookies are controlled by the requesting client. Unless another trusted layer independently validates the session, an attacker can create an arbitrary `session` cookie and satisfy the middleware’s only authentication condition. This pattern is especially hazardous because it is presented as a production authentication pattern. Applications that copy it may rely on the middleware as their primary access-control boundary. Route-level authorization does not correct the middleware flaw unless every protected page, API handler, and Server Action independently validates the authenticated session. ### Attack Path 1. The ...[truncated 1407 chars]- Remediation
View remediation