What is an unprotected API route?
An unprotected API route is a backend address that anyone on the internet can call, because it never checks who's asking. It might return private data, change a record or send an email, and it needs no login at all.
Also called: Missing authentication
ON THIS PAGE
What it means
Your front end calls your backend through addresses like /api/users or /api/export. The pages might need a login, but the routes behind them often don't, and a person can type those addresses into a browser or script directly.
Route protection must live on the server. A hidden button or a page that redirects to a login screen only affects what real visitors see.
Why it matters for vibe-coded apps
AI tools build the screen and the route separately. The screen asks for login, but the route is often left open, especially for routes added later.
- Private data can be downloaded without an account.
- Anyone can trigger actions, like emails, exports or deletions.
- Routes meant for admins can be called by the public.
Example
An export route for admins.
app.get("/api/admin/export-users", async (req, res) => {
res.json(await db.users.findAll());
});app.get("/api/admin/export-users", requireLogin, requireRole("admin"), async (req, res) => {
res.json(await db.users.findAll());
});Make "protected by default" your rule: add a login check globally and open up only the routes that must be public.
How to check if your app has this problem
- 1List every route in your backend, then call each one with no login (a browser address bar works for GET routes).
- 2Look at free checks for common paths such as /api/admin, /api/users and /api/export.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Add a login check as the default for all routes.
- 2Add a role check to admin routes.
- 3Remove old test and debug routes.
- 4Run a check again to confirm they're locked.
List every API route in my backend and whether it requires login. Make login required by default, add role checks to admin routes, and delete any debug or test routes that aren't needed.
Check if your app has this problem
Paste your website and we'll check for unprotected API route issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Broken access controlA logged-in user can reach data or actions that should belong to someone else.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- Insecure direct object reference (IDOR)Changing an ID in a web address shows someone else's data.
- JSON Web Token (JWT)A signed pass your app hands a user after they log in.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.