SAST scanner · reads the Express source

Express Middleware Analyzer

Express has no file that declares what is protected. Protection is whatever the route lines and middleware files say. This analyzer reads both: it checks each route for a guard among its own arguments, judges the auth middleware files, and then looks for rate limiting, security headers, CORS and tenant isolation.

SASTup to HighAuth Weakness6 checksExpress only

Route coverage

The analyzer runs only when the repository contains an Express app: a file that mentions express together with app.listen(, express() or express.Router(). Four routes below go through three gates in order.

app.js app.use("/api", authMiddleware) app.get("/api/admin/users", getUsers) app.get("/api/health", ping) app.post("/api/tasks", requireAuth, createTask) app.get("/", home) only the arguments after a route's path count as guards app.use("/api", ...) is kept as a mount point and covers no route in this check args: getUsers. No guard name among them. path /api/admin/users contains /api/ and /admin. GET /api/admin/users has no auth middleware args: ping. No guard, but the path contains /health, which is on the public list. Not examined further. args: requireAuth, createTask. requireAuth is a known guard name, matched on word boundaries, so the route is skipped. args: home. No guard, not public, but the path "/" holds none of the sensitive words, so it is not judged. 4 routes read, 1 finding routeguardpublicsensitive /api/admin/usersGET nonoyes MEDIUM · 0.85 /api/healthGET noyes- skipped /api/tasksPOST yes-- skipped /GET nonono skipped

1The route mapper reads each app.get(path, ...args) line. Only the arguments after the path count as guards. The app.use("/api", authMiddleware) line is recorded as a mount point and covers no route in this check.

2/api/admin/users: no guard in its arguments, not a public path, and the path holds /api/ and /admin. Medium, 0.85, one finding per HTTP method. The global app.use above it does not rescue it.

3/api/health has no guard either, but /health is on the public list with /ping, /status, /docs, /swagger, /openapi and /webhook. It is skipped.

4/api/tasks names requireAuth among its arguments. Guard names are matched on word boundaries, so checkAuthorEmail would not pass for checkAuth. Skipped.

5/ has no guard and is not public, but nothing in its path says it is sensitive: the list is /api/, /trpc, /graphql, /admin, /user, /account, /settings, /payment, /billing, /profile, /dashboard. One finding in all.

Auth middleware quality

A guard that exists can still be useless. Two middleware files, one that only checks a header is present and one that verifies a token.

middleware/auth.js function auth(req, res, next) { if (req.headers.authorization) { return next() } return res.status(401).end() } middleware/jwt.js function auth(req, res, next) { try { req.user = jwt.verify(token, SECRET) return next() } catch { return res.status(401).end() } } Files scanned every file whose path holds middleware/ or middlewares/, or whose name contains "middleware" three buckets of patterns: strong (a token is verified), weak (a header or cookie merely exists), enforcement (401 or 403) HIGH · 0.80 Auth middleware checks token existence but not validity weak pattern: req.headers.authorization followed by ) or && : the header is tested for truth only no strong pattern has been seen yet, so the file is reported. Any string would pass as a Bearer token. No finding jwt.verify( is a strong pattern. A file with both patterns is not reported, and neither is a weak file that comes after it. The check is order-sensitive across files: a weak file scanned before the strong one is reported. No guard found anywhere 1. every middleware file: no strong or weak pattern 2. every other file in the repo (main.js, app.js ...): none of the strong patterns either supabase.auth.getUser( jwt.verify( jsonwebtoken ... verify getUser(token verifyToken( getSession( passport.authenticate( If Express routes exist, the scanner reports one finding for the whole backend: HIGH · 0.90 No auth verification middleware found Without it each route must do its own authentication, which is error-prone and inconsistent.

1The analyzer collects the middleware files of an Express app and reads them for three kinds of pattern: strong verification, weak existence tests, and 401 or 403 enforcement.

2if (req.headers.authorization) only asks whether the header is truthy. With no verification pattern yet seen, the file is a High finding, 0.80: any string sent as a Bearer token gets through.

3jwt.verify( is a strong pattern: the token is checked, not just present. This file is clean, and a strong hit also protects weak files that come after it in the scan.

4If no strong pattern exists in any file at all, and the repository has Express routes, one High finding, 0.90 reports that there is no verifying middleware anywhere.

The four hygiene checks

These checks have no per-route logic. Each searches the middleware files, and for some checks the main files too, for a named tool.

checkwhat it looks forwhat it reports Rate limiting looks for rateLimit(, express-rate-limit, createRateLimiter(, slowDown(a Map or memoryStore with no Redis import counts as in-memory MEDIUM · 0.80No rate limiting middleware found Security headers helmet anywhere clears every header checkelse the four recommended names are searched as text LOW · 0.85 per headerHSTS, X-Frame-Options, X-Content-Type-Options, CSP CORS origin: '*' and credentials: true in one filetwo files each holding one half do not count HIGH · 0.85CORS allows all origins with credentials Tenant isolation only if the code mentions tenant_id and a tenants tablelooks for req.tenantId, tenantContext(, requireTenant( ... HIGH · 0.75No tenant isolation middleware found

1Besides auth, the Express analyzer runs four hygiene checks on the same files. They share one pattern: look for the protective tool by name, and report its absence.

2Rate limiting. No limiter anywhere is Medium, 0.80. A limiter that keeps counters in a Map without a shared store is Medium, 0.70, because each instance counts separately and an attacker multiplies the limit by the instance count.

3Security headers. helmet clears all of them. Without it, each of four missing headers is its own Low finding, 0.85: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and Content-Security-Policy.

4CORS. Both halves have to sit in one file: origin: '*' and credentials: true. High, 0.85. It lets any website make credentialed requests.

5Tenant isolation. A repository that mentions tenant_id and defines tenants is multi-tenant; if no tenant middleware name appears anywhere, High, 0.75.

Why it matters

Why it matters

Express runs its functions in the order they are registered, and a guard only protects the routes that name it. A single route without the guard is open to anyone, and the rest of the API looking protected hides it. This is the Express counterpart of the Next.js matcher gap.

Real-world breach

Peloton (2021). Unauthenticated API endpoints exposed user data. The markdown reads this as an API that likely had auth middleware which was not applied to every route, the pattern this scanner looks for.

Vulnerable vs fixed code

// BAD: no guard among this route's arguments
app.get("/api/admin/users", getUsers)

// BAD: middleware that only tests that a header exists
function auth(req, res, next) {
  if (req.headers.authorization) return next()
  return res.status(401).end()
}

// BAD: auth applied after the routes it was meant to cover
app.use(authMiddleware)
Scope note

The analyzer does not model registration order or wildcard bypass by route specificity. It treats a route as guarded only when a guard name appears in that route's own arguments, so app.use("/api", authMiddleware) placed correctly above the routes still leaves per-route findings.

Limits and scope

BehaviourDetail
InputThe repository source. Runs only when a file mentions express with app.listen(, express() or express.Router(). tRPC and Next.js route.ts files are excluded from the route list.
Severity and confidenceNo verifying middleware: High 0.90. Weak token check: High 0.80. Route without guard: Medium 0.85 per method. Rate limit: Medium 0.80, in-memory 0.70. Headers: Low 0.85 each. CORS: High 0.85. Tenant isolation: High 0.75.
Route guardA known guard name (such as requireAuth, verifyAuth, authenticate, isAuthenticated, verifyToken, authMiddleware) among the route's arguments on its line. Global app.use is not counted.
Which routes are judgedNot public (/health, /ping, /status, /docs, /swagger, /openapi, /webhook) and sensitive (/api/, /trpc, /graphql, /admin, /user, /account, /settings, /payment, /billing, /profile, /dashboard).
Not implementedMiddleware ordering, and bypass by route specificity.