# Missing Authentication for Critical Function (CWE-306)

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

**Stack:** JavaScript

- Prevalence: 高 頻繁に悪用される
- Impact: ハイ 6 件の重大度ハイのルール
- Prevention: 文書化済み 6 件の修正例

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

As data traverses trust boundaries, the data should be validated before being processed. When authentication is not applied to critical functions, attackers can invoke these functions without proving their identity.

## Prevention

### JavaScript

Add @UseGuards decorator with authentication guard at controller or method level

## Warning Signs

- [HIGH] NestJS endpoint has no @UseGuards() decorator for authentication

## Consequences

- 権限の取得
- アプリケーションデータの読み取り
- アプリケーションデータの変更
- 未承認コードの実行

## Mitigations

- ソフトウェアを信頼レベルの異なるコンポーネントに分割する
- セキュリティ上重要な機能を持つすべての領域を特定し、それらすべてに認証を要求する
- 適切なアクセス制御が確実に強制されるようにする

## Detection

- Total rules: 6
- Languages: python, go, typescript

## Rules by Language

### Typescript (1 rules)

- **NestJS Endpoint Missing Authentication Guard** [HIGH]: Endpoints without @UseGuards or @Public decorators are accessible to
unauthenticated users, enabling unauthorized access.
  - Remediation: Add @UseGuards decorator at controller or method level.

```typescript
import { UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';

@Controller('users')
@UseGuards(JwtAuthGuard)
export class UsersController {
  @Get(':id')
  findOne(@Param('id') id: string) {
    return this.usersService.findOne(id);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-306/missing-auth-guard