CWE-287 in Fiber

CWE-287 describes improper authentication, where an application does not adequately verify the identity of a user or service before granting access to a protected resource. In the Fiber web framework, this often appears when a route that should be restricted is defined without an authentication guard.

Typical attack patterns include:

• Leaving a route public while expecting it to be reachable only by authenticated users.
• Relying on client-side checks such as JavaScript validation to enforce access.
• Using default or hard-coded credentials for internal services.
• Skipping session validation after a token is issued.

For example, a developer might define an endpoint that creates a new record but does not require a token:

// ❌ Vulnerable route in Fiber
app.post('/api/records', (req, res) => {
  // business logic
  res.send({ status: 'created' });
});

Because no authentication middleware is attached, any unauthenticated client can invoke the endpoint, leading to CWE-287.

middleBrick can detect this issue automatically without any configuration. By running a simple CLI command, you receive a security score and a finding that highlights the missing authentication check.

middlebrick scan https://api.example.com/api/records

The scan evaluates the endpoint against the 12 security checks and returns a finding similar to: