Unprotected API Routes in AI-Generated Code: How to Fix Them

Why AI-Generated APIs Skip Authentication

When you prompt an AI tool to "create an API endpoint that returns user orders," it builds the fastest working solution: a route that responds to any HTTP request. Authentication is context that AI models frequently drop because it was not explicit in the prompt and because training examples on the open web are full of tutorial code that skips auth for brevity.

The result is routes like /api/admin/users, /api/delete-account, or /api/send-email sitting wide open in production. According to the OWASP API Security Top 10 (2023), Broken Object Level Authorization and Broken Authentication together account for the top two API security failures. AI-generated codebases amplify this problem because many routes are wired up quickly and never audited.

A 2023 study by Apiiro found that AI-generated code introduces vulnerabilities at 2.74x the rate of human-written code, with authentication bypasses among the most frequently cited categories. GitHub's 2024 Octoverse report noted that over 40% of AI code suggestions in security-sensitive files contained at least one flaw reviewers had to manually correct.

What an Unprotected Route Looks Like

Here is a typical pattern that Cursor or Bolt generates for a Next.js API route. The business logic is correct, but there is no check that the caller is authenticated or authorized.

// ❌ BAD - No authentication check
// pages/api/admin/users.ts (Next.js Pages Router)
import { db } from '@/lib/db';

export default async function handler(req, res) {
  if (req.method === 'GET') {
    const users = await db.user.findMany();
    return res.status(200).json(users);
  }

  if (req.method === 'DELETE') {
    const { userId } = req.body;
    await db.user.delete({ where: { id: userId } });
    return res.status(200).json({ success: true });
  }
}

This route leaks every user record to any unauthenticated caller and lets anyone delete accounts. Because it lives under /api/admin/, a developer might assume it is protected by some server-level rule - but Next.js and Vercel do not add authentication automatically. The path naming means nothing to the runtime.

The Right Pattern: Middleware-Level Auth

The most reliable fix is enforcing authentication at the middleware layer so no request reaches a protected route without a valid session. This means one change protects every route in a directory.

// ✅ GOOD - Auth enforced in Next.js middleware
// middleware.ts (Next.js App Router)
import { NextResponse } from 'next/server';
import { getToken } from 'next-auth/jwt';

export async function middleware(req) {
  const token = await getToken({ req, secret: process.env.NEXTAUTH_SECRET });

  if (!token) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  // Optional: role check for admin routes
  if (req.nextUrl.pathname.startsWith('/api/admin') && token.role !== 'admin') {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/api/admin/:path*', '/api/user/:path*'],
};

With this middleware in place, every route matching the pattern is protected automatically. You do not need to add an auth check inside each individual handler - which is exactly the kind of repetitive work AI tools forget to do.

Common Patterns That AI Tools Miss

Object-Level Authorization: The Next Layer

Even after adding authentication, AI-generated routes often skip the second check: does this authenticated user own the resource they are requesting? OWASP calls this Broken Object Level Authorization (BOLA), and it is the leading API vulnerability in the 2023 Top 10.

An authenticated user should only be able to read or modify their own records. If AI generates GET /api/orders/:id that returns any order by ID without verifying ownership, any logged-in user can enumerate and read every order in your system simply by iterating the ID parameter.

The fix is always to scope database queries to the authenticated user's identity - for example, adding where: { id: orderId, userId: session.user.id } to any Prisma or Drizzle query that fetches a user-owned resource.

How to Find Unprotected Routes in Your Codebase

Manual auditing works for small projects but breaks down once a Bolt or Lovable scaffold generates dozens of routes. A systematic approach:

1. List every route file. In Next.js App Router, every route.ts file under app/api/ is a live endpoint. In Express, look for app.get(), app.post(), router.delete(), and similar calls.
2. Check each handler for an auth call. Look for getServerSession, getToken, verifyJWT, or Supabase's auth.getUser(). If neither is present and the route touches the database, it is a candidate for exposure.
3. Test unauthenticated. Use curl or Postman without any Authorization header and call every API route. Any 200 response from a route that should require login is a confirmed finding.
4. Run automated scanning. Tools like VibeDoctor (vibedoctor.io) automatically scan your codebase for unprotected API routes and flag specific file paths and line numbers. Free to sign up.

FAQ