# Missing Authentication for Critical Function (CWE-306)

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

**Stack:** Go

- Prevalence: उच्च बार-बार शोषित
- Impact: उच्च 6 उच्च गंभीरता वाले नियम
- Prevention: प्रलेखित 6 फिक्स उदाहरण

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

As data traverses trust boundaries, the data should be validated before being processed. When authentication is not applied to critical functions, attackers can invoke these functions without proving their identity.

## Prevention

### Go

Add Echo JWT middleware to protect API endpoints

Add Fiber JWT middleware to protect API endpoints

Add JWT authentication middleware to protect API endpoints

## Warning Signs

- [HIGH] Gin application missing JWT authentication middleware

## Consequences

- विशेषाधिकार प्राप्त करना
- एप्लिकेशन डेटा पढ़ना
- एप्लिकेशन डेटा संशोधित करना
- अनधिकृत कोड निष्पादित करना

## Mitigations

- सॉफ़्टवेयर को विभिन्न विश्वास स्तरों वाले कॉम्पोनेंट्स में विभाजित करें
- सुरक्षा-गंभीर कार्यक्षमता वाले सभी क्षेत्रों की पहचान करें और उन सभी के लिए प्रमाणीकरण अनिवार्य करें
- सुनिश्चित करें कि उचित पहुँच नियंत्रण लागू किए गए हैं

## Detection

- Total rules: 6
- Languages: python, go, typescript

## Rules by Language

### Go (3 rules)

- **Echo Missing JWT Middleware** [HIGH]: API endpoints lack JWT authentication middleware protection.
  - Remediation: Add JWT middleware to protect API routes.

```go
import "github.com/labstack/echo-jwt/v4"

api := e.Group("/api")
api.Use(echojwt.JWT([]byte(os.Getenv("JWT_SECRET"))))
api.POST("/transfer", transferHandler)
```

Learn more: https://shoulder.dev/learn/go/cwe-306/jwt-middleware
- **Fiber Missing JWT Middleware** [HIGH]: API endpoints lack JWT authentication middleware protection.
  - Remediation: Add JWT middleware to protect API routes.

```go
import "github.com/gofiber/contrib/jwt"

api := app.Group("/api")
api.Use(jwtware.New(jwtware.Config{
    SigningKey: jwtware.SigningKey{Key: []byte(os.Getenv("JWT_SECRET"))},
}))
api.Post("/transfer", transferHandler)
```

Learn more: https://shoulder.dev/learn/go/cwe-306/jwt-middleware
- **Gin Missing JWT Middleware** [HIGH]: API endpoints lack JWT authentication middleware protection.
  - Remediation: Add JWT middleware to protect API routes.

```go
import jwt "github.com/appleboy/gin-jwt/v2"

auth, _ := jwt.New(&jwt.GinJWTMiddleware{
    Realm: "api",
    Key:   []byte(os.Getenv("JWT_SECRET")),
})
api := r.Group("/api")
api.Use(auth.MiddlewareFunc())
api.POST("/transfer", transferHandler)
```

Learn more: https://shoulder.dev/learn/go/cwe-306/jwt-middleware