# Missing Authentication for Critical Function (CWE-306)

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

**Stack:** JavaScript

- Prevalence: 높음 자주 악용됨
- Impact: 높음 6개의 높은 심각도 규칙
- Prevention: 문서화됨 6개의 수정 예시

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

As data traverses trust boundaries, the data should be validated before being processed. When authentication is not applied to critical functions, attackers can invoke these functions without proving their identity.

## Prevention

### JavaScript

Add @UseGuards decorator with authentication guard at controller or method level

## Warning Signs

- [HIGH] NestJS endpoint has no @UseGuards() decorator for authentication

## Consequences

- 권한 획득
- 애플리케이션 데이터 읽기
- 애플리케이션 데이터 수정
- 승인되지 않은 코드 실행

## Mitigations

- 소프트웨어를 신뢰 수준이 다른 구성 요소로 나누세요
- 보안에 중요한 기능이 있는 모든 영역을 식별하고 해당 영역마다 인증을 요구하세요
- 적절한 접근 제어가 강제되도록 하세요

## Detection

- Total rules: 6
- Languages: python, go, typescript

## Rules by Language

### Typescript (1 rules)

- **NestJS Endpoint Missing Authentication Guard** [HIGH]: Endpoints without @UseGuards or @Public decorators are accessible to
unauthenticated users, enabling unauthorized access.
  - Remediation: Add @UseGuards decorator at controller or method level.

```typescript
import { UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';

@Controller('users')
@UseGuards(JwtAuthGuard)
export class UsersController {
  @Get(':id')
  findOne(@Param('id') id: string) {
    return this.usersService.findOne(id);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-306/missing-auth-guard