{
  "id": 19129407,
  "title": "API routes and admin pages anyone can call",
  "url": "https://urgent.news/2026/11/09/api-routes-and-admin-pages-anyone-can-call",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T09:40:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/axonscape/api-routes-and-admin-pages-anyone-can-call-1pmk"
  },
  "original_language": "en",
  "account": "The issue at hand involves API routes, server actions, and admin pages that anyone can access without proper authentication. These vulnerabilities arise when AI tools generate the features without including a step to verify the identity of the user making the request. A straightforward solution would be to include sign-in checks at the beginning of each route and action that modifies data. If no user is signed in, or if the user lacks permission to make changes, the system should return an error code 401 or 403, respectively. The same principle applies to admin pages; they should be protected by checking whether the user is an admin, typically implemented through middleware or within the admin layout. Public-facing forms, such as contact or waitlist forms, are acceptable without requiring sign-in, but they should be safeguarded against automated bots through additional checks. To address this issue, a simple fix can be implemented using provided code snippets that can be integrated into various AI-assisted development environments like Lovable, Bolt, v0, Replit, or Cursor. The complete guide and request template are available on a dedicated webpage.",
  "summary": "Routes and server actions that change data without checking who's signed in, and admin pages hidden only by not linking to them, are open to anyone who finds the address. What you see An /api route or server action writes to the database with no sign-in check, or /admin opens for anyone who types the address. Why it happens AI tools build the feature first; checking who's asking is a separate…",
  "key_points": [
    "API routes and admin pages lack authentication",
    "Include sign-in checks for data-modifying routes/actions",
    "Protect admin pages with user permission verification"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}