Insecure Authentication Detection — ShipSafe

What is Insecure Authentication?

Insecure authentication encompasses vulnerabilities in how applications verify user identity and manage sessions. Weak authentication allows attackers to compromise passwords, keys, or session tokens, or exploit implementation flaws to assume other users' identities.

What ShipSafe Detects

• ✓Missing authentication middleware on sensitive routes
• ✓Weak password hashing (MD5, SHA1, SHA256 without salt)
• ✓JWT misconfigurations: algorithm confusion, missing expiration, weak secrets
• ✓Session fixation vulnerabilities
• ✓Missing CSRF protection on state-changing endpoints
• ✓Insecure cookie settings (missing httpOnly, secure, sameSite)
• ✓Broken access control where users can access others' resources
• ✓Password stored in localStorage or sessionStorage

Example: Vulnerable Code

Missing authentication and weak password hashing

// Vulnerable: no auth middleware on admin route
app.delete("/api/users/:id", async (req, res) => {
  await db.query("DELETE FROM users WHERE id = $1", [req.params.id]);
  res.json({ deleted: true });
});

// Vulnerable: weak password hashing
const crypto = require("crypto");
const hash = crypto.createHash("md5").update(password).digest("hex");

ShipSafe Catches It

$ shipsafe scan

  HIGH  auth/missing-auth-middleware
  src/routes/admin.ts:1
  DELETE endpoint /api/users/:id has no authentication middleware.
  Fix: Add authentication middleware — app.delete("/api/users/:id", requireAuth, async (req, res) => { ... })

  HIGH  auth/weak-password-hash
  src/auth.ts:3
  MD5 used for password hashing. MD5 is cryptographically broken.
  Fix: Use bcrypt or argon2 — await bcrypt.hash(password, 12)

Related Security Categories