# Direct Request ('Forced Browsing') (CWE-425)

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

- Prevalence: 高 頻繁に悪用される
- Impact: ハイ 1 件の重大度ハイのルール
- Prevention: 文書化済み 1 件の修正例

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Attackers can directly access URLs that should be protected by authentication or authorization. This often occurs when access controls are only enforced on the main navigation but not on direct URL access.

## Prevention

### Python

Add authentication and admin-role checks to all administrative endpoints

## Warning Signs

- [HIGH] administrative endpoints (admin, debug, internal, system) that lack
proper authentication or authori

## Consequences

- アプリケーションデータの読み取り
- アプリケーションデータの変更
- 権限の取得

## Mitigations

- 保護されたすべてのリソースに対してサーバー側のアクセス制御チェックを実装する
- クライアント側のアクセス制御だけに依存しない
- 認可は集中管理された仕組みを使用する

## Detection

- Total rules: 1
- Languages: python

## Rules by Language

### Python (1 rules)

- **Exposed Administrative Endpoint** [HIGH]: Detects administrative endpoints (admin, debug, internal, system) that lack
proper authentication or authorization checks. These endpoints should require
admin privileges and be protected from public access.
  - Remediation: Add authentication decorator to admin endpoints.

```python
from flask_login import login_required, current_user
from functools import wraps

def admin_required(f):
    @wraps(f)
    @login_required
    def decorated(*args, **kwargs):
        if not current_user.is_admin:
            abort(403)
        return f(*args, **kwargs)
    return decorated

@app.route('/admin/users')
@admin_required
def admin_users():
    return jsonify(get_users())
```

Learn more: https://shoulder.dev/learn/python/cwe-425/exposed-admin-endpoint