Insecure Authentication Detection — ShipSafe

What is Insecure Authentication?

Insecure authentication encompasses vulnerabilities in how applications verify user identity and manage sessions. Weak authentication allows attackers to compromise passwords, keys, or session tokens, or exploit implementation flaws to assume other users' identities.

Why It Matters

Authentication is the front door of your application. When it fails, every other security control fails too — access control, audit logging, data isolation, all of it depends on knowing who the user is. Weak password hashing means a database breach becomes a mass password compromise. JWT misconfiguration can let attackers forge tokens and impersonate any user, including administrators. Missing auth on API routes is the most common vulnerability in AI-generated code, because AI assistants focus on the business logic and forget the security layer.

What ShipSafe Detects

• ✓Missing authentication middleware on sensitive routes (DELETE, PUT, PATCH, and admin endpoints)
• ✓Weak password hashing: MD5, SHA1, SHA256 without salt, and single-round hashing without a work factor
• ✓JWT misconfigurations: algorithm confusion (accepting 'none'), missing exp claim, HS256 with a weak secret, RS256 key confusion
• ✓Session fixation vulnerabilities where session ID is not regenerated after login
• ✓Missing CSRF protection on state-changing endpoints (POST, PUT, DELETE without CSRF token validation)
• ✓Insecure cookie settings: missing httpOnly (allows JS access), missing secure (sent over HTTP), missing sameSite (cross-site request risk)
• ✓Broken access control where users can access other users' resources by changing an ID parameter (IDOR)
• ✓Password or tokens stored in localStorage or sessionStorage (accessible to any XSS payload)

Example: Vulnerable Code

Missing authentication and weak password hashing

// Vulnerable: no auth middleware on admin route
app.delete("/api/users/:id", async (req, res) => {
  await db.query("DELETE FROM users WHERE id = $1", [req.params.id]);
  res.json({ deleted: true });
});
// Anyone on the internet can delete any user!

// Vulnerable: weak password hashing
const crypto = require("crypto");
const hash = crypto.createHash("md5").update(password).digest("hex");
// MD5 produces identical hashes for identical passwords (no salt)
// and can be brute-forced at billions of attempts per second on a GPU.

ShipSafe Catches It

$ shipsafe scan

  HIGH  auth/missing-auth-middleware
  src/routes/admin.ts:1
  DELETE endpoint /api/users/:id has no authentication middleware.
  Fix: Add authentication middleware — app.delete("/api/users/:id", requireAuth, async (req, res) => { ... })

  HIGH  auth/weak-password-hash
  src/auth.ts:3
  MD5 used for password hashing. MD5 is cryptographically broken.
  Fix: Use bcrypt or argon2 — await bcrypt.hash(password, 12)

What to Do Instead

Safe alternatives: auth middleware, bcrypt hashing, and secure cookie settings

// SAFE: auth middleware + authorization check
import { requireAuth, requireRole } from "./middleware/auth";

app.delete("/api/users/:id", requireAuth, requireRole("admin"),
  async (req, res) => {
    await db.query("DELETE FROM users WHERE id = $1", [req.params.id]);
    res.json({ deleted: true });
  }
);

// SAFE: bcrypt password hashing with work factor
import bcrypt from "bcrypt";

// Hash with cost factor 12 (~250ms per hash — fast enough for login,
// slow enough to make brute force infeasible)
const hash = await bcrypt.hash(password, 12);

// Verify
const isValid = await bcrypt.compare(inputPassword, storedHash);

// SAFE: secure cookie settings
app.use(session({
  cookie: {
    httpOnly: true,   // JS cannot read the cookie (blocks XSS theft)
    secure: true,     // only sent over HTTPS
    sameSite: "lax",  // blocks cross-site request forgery
    maxAge: 24 * 60 * 60 * 1000, // 24 hours
  },
}));

Frequently Asked Questions

Related Security Categories