NestJS Endpoint Missing Authentication Guard

Description

Endpoints without @UseGuards or @Public decorators are accessible to unauthenticated users, enabling unauthorized access.

What Shoulder detects

NestJS endpoint has no @UseGuards() decorator for authentication

How to fix

Add @UseGuards decorator at controller or method level.

```typescript
import { UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';

@Controller('users')
@UseGuards(JwtAuthGuard)
export class UsersController {
  @Get(':id')
  findOne(@Param('id') id: string) {
    return this.usersService.findOne(id);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-306/missing-auth-guard

Applies to

Languages

🔷 TypeScript

Frameworks

nestjs

References

Documentation ↗ Learn about CWE-306

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=nestjs-missing-auth-guard .