The One Route That Forgot to Check

Most APIs we test enforce authorization consistently — a gateway or middleware checks the caller's token before any handler runs. Then there is the one route that does not.

The Pattern

A modern API exposes dozens of endpoints. Twenty-three of them return 401 without a valid token. The twenty-fourth returns 200 and a payload. Not because of a clever bypass — because authorization was wired up per-handler, and one handler was missed.

This is Broken Object Level Authorization and its siblings, still the top entry on the OWASP API Security list, and still the most common serious finding in our engagements.

"Authorization is not a feature you add. It is an invariant you have to prove holds everywhere."

How We Find It

• Enumerate the full route inventory — from source maps, OpenAPI specs, and client bundles, not just the documented endpoints.
• Probe every route unauthenticated, then as a low-privilege user against another user's object IDs.
• Treat inconsistency as the signal: when sibling routes disagree on auth, one of them is wrong.

A scanner sees a 200 and moves on. A tester asks why this 200 exists when its neighbors do not. That question is the engagement.