Search documentation of Metastatic

# Metastatic.Analysis.BusinessLogic.MissingAuthentication (Metastatic v0.13.2)

View Source

Detects critical functions without authentication checks (CWE-306).

This analyzer identifies endpoints or functions that perform sensitive operations but lack apparent authentication verification.

## Cross-Language Applicability

Missing authentication is a universal access control vulnerability:

- Elixir/Phoenix: Controller action without `plug :authenticate`
- Python/Django: View without `@login_required` decorator
- JavaScript/Express: Route without auth middleware
- Ruby/Rails: Controller without `before_action :authenticate_user!`
- Java/Spring: Endpoint without `@PreAuthorize` or security config
- C#/ASP.NET: Action without `[Authorize]` attribute
- Go: Handler without auth middleware in chain

## Problem

When critical functions lack authentication:

- Anonymous users can access protected resources
- Sensitive operations can be performed without identity verification
- Data exposure to unauthorized parties
- System integrity compromised

## Detection Strategy

Detects patterns where:

1. Functions named as critical actions (admin, delete, update, etc.)
2. Functions in controller/handler modules
3. No authentication check is apparent in the function or module context