NestJS Sensitive Route Missing Guard

Description

Controllers without @UseGuards on sensitive operations allow unauthorized access to create, update, delete, and admin endpoints.

What Shoulder detects

Controller method '{method}' performs sensitive operation '{operation}' without @UseGuards decorator. This endpoint is publicly accessible.

How to fix

Add @UseGuards decorator to sensitive endpoints.

```typescript
import { UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('users')
export class UserController {
  @Delete(':id')
  @UseGuards(AuthGuard('jwt'))
  deleteUser(@Param('id') id: string) {
    return this.userService.delete(id);
  }
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-285/missing-route-guard

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

nestjs

References

Documentation ↗ OWASP ↗ Learn about CWE-285

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=nestjs-missing-route-guard .