CRITICAL: Authentication is completely disabled — authMiddleware returns mock user for all requests #4

New issue

Closed

opened 2026-05-09 00:00:13 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 00:00:13 +00:00

Owner

Severity: Critical

Location

backend/src/auth.ts lines 20–28

Description

The authMiddleware function completely ignores JWT tokens and returns a hardcoded anonymous user for EVERY request:

export const authMiddleware = (req: AuthRequest, res: Response, next: NextFunction): void => {
  // AUTHENTICATION DISABLED - always allow requests
  // Create a mock user for all requests
  req.user = { 
    userId: 'anonymous-user', 
    email: 'anonymous@subvault.local' 
  };
  next();
};

This means any protected endpoint (/api/subscriptions, /api/auth/me, /api/pricing, /api/news, /api/dashboard/stats) is accessible to anyone without any authentication. All users share a single anonymous user context, so subscription data is not isolated.

Impact

No access control: Anyone can call any protected API endpoint
No data isolation: All users effectively share the same anonymous-user context
False sense of security: The frontend shows a login/register flow but the backend enforces nothing

Suggested Fix

Remove the hardcoded mock user. Re-enable real JWT verification:

export const authMiddleware = (req: AuthRequest, res: Response, next: NextFunction): void => {
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    res.status(401).json({ error: 'No token provided' });
    return;
  }
  try {
    const token = authHeader.split(' ')[1];
    req.user = verifyToken(token);
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
};

Note

If the NO_AUTH mode is intentionally for development, it should be gated behind an environment variable check, not the default behavior.

## Severity: Critical ## Location `backend/src/auth.ts` lines 20–28 ## Description The `authMiddleware` function completely ignores JWT tokens and returns a hardcoded anonymous user for EVERY request: ```typescript export const authMiddleware = (req: AuthRequest, res: Response, next: NextFunction): void => { // AUTHENTICATION DISABLED - always allow requests // Create a mock user for all requests req.user = { userId: 'anonymous-user', email: 'anonymous@subvault.local' }; next(); }; ``` This means any protected endpoint (`/api/subscriptions`, `/api/auth/me`, `/api/pricing`, `/api/news`, `/api/dashboard/stats`) is accessible to anyone without any authentication. All users share a single anonymous user context, so subscription data is not isolated. ## Impact - **No access control**: Anyone can call any protected API endpoint - **No data isolation**: All users effectively share the same `anonymous-user` context - **False sense of security**: The frontend shows a login/register flow but the backend enforces nothing ## Suggested Fix Remove the hardcoded mock user. Re-enable real JWT verification: ```typescript export const authMiddleware = (req: AuthRequest, res: Response, next: NextFunction): void => { const authHeader = req.headers.authorization; if (!authHeader || !authHeader.startsWith('Bearer ')) { res.status(401).json({ error: 'No token provided' }); return; } try { const token = authHeader.split(' ')[1]; req.user = verifyToken(token); next(); } catch { res.status(401).json({ error: 'Invalid token' }); } }; ``` ## Note If the `NO_AUTH` mode is intentionally for development, it should be gated behind an environment variable check, not the default behavior.