Securing Endpoints: Stop Trusting Whoever Can Reach the URL

// api/send-welcome-email.ts — looks done, isn't
export default async function handler(req: Request, res: Response) {
  const { customerEmail, customerName, courseLink } = req.body;

  await sendEmail({
    to: customerEmail,
    from: 'noreply@example.com',
    subject: `Welcome, ${customerName}!`,
    html: `<p>Hi ${customerName}, here's your course: <a href="${courseLink}">${courseLink}</a></p>`,
  });

  return res.status(200).json({ sent: true });
}

// Also broken: identity from the body, not from a verified session
const { userId, email } = req.body;
await db.profiles.update({ where: { id: userId }, data: { marketing: true } });

// Vulnerable: no CRLF stripping, weak validation
const message = `From: "${name}" <noreply@example.com>\r\nReply-To: ${email}\r\nSubject: ${subject}\r\n\r\n${body}`;
// subject = "Hi\r\nBcc: victim1@evil.com,victim2@evil.com" sails right through
// if the validation regex only checks a loose charset (e.g. \s which matches \r\n)

# 1. Find all API route handlers
grep -rn "export default async function handler\|export async function POST\|app.post\|router.post" --include="*.ts" --include="*.tsx" .

# 2. For each one, check whether it verifies a session/token before doing anything
#    Look specifically for routes with NO match on these auth patterns:
grep -L "requireAuth\|verifyToken\|getUser(\|auth.uid()\|Authorization" $(grep -rl "export default async function handler\|app.post" --include="*.ts" .)

# 3. Find places that trust body-supplied identity instead of a verified session
grep -rn "req.body.userId\|req.body.email\|body\.userId\|body\.email" --include="*.ts" .
# For each hit: is userId/email later used to authorize an action, or just derived
# from req.user / a verified JWT? If it comes from the body, that's the bug.

# 4. Find raw email/header construction that could be CRLF-injected
grep -rn "From:.*\${" --include="*.ts" .
grep -rn "\\\\r\\\\n" --include="*.ts" .

// api/lib/auth.ts — shared helpers
import { timingSafeEqual } from 'crypto';

export function verifyInternalSecret(req: Request): boolean {
  const expected = process.env.INTERNAL_API_SECRET;
  const provided = req.headers['x-internal-secret'];
  if (!expected) return false; // fail CLOSED if unset, never fail open
  if (typeof provided !== 'string' || provided.length !== expected.length) return false;
  return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
}

export async function verifyUser(req: Request): Promise<{ id: string; email: string } | null> {
  const token = req.headers.authorization?.replace('Bearer ', '');
  if (!token) return null;
  const { data, error } = await supabaseAdmin.auth.getUser(token);
  if (error || !data.user) return null;
  return { id: data.user.id, email: data.user.email! };
}

// api/send-welcome-email.ts — fixed
export default async function handler(req: Request, res: Response) {
  if (!verifyInternalSecret(req)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  // Even internal calls should pass a structured, validated payload —
  // Zod-validate it, don't just trust the shape.
  const parsed = welcomeEmailSchema.safeParse(req.body);
  if (!parsed.success) return res.status(400).json({ error: 'Invalid payload' });

  await sendEmail({
    to: parsed.data.customerEmail,
    from: 'noreply@example.com',
    subject: `Welcome, ${escapeHtml(parsed.data.customerName)}!`,
    html: renderWelcomeTemplate(parsed.data), // template escapes all interpolated values
  });

  return res.status(200).json({ sent: true });
}

// The caller (your webhook handler) sends the secret on every internal call
await fetch(`${INTERNAL_BASE_URL}/api/send-welcome-email`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-internal-secret': process.env.INTERNAL_API_SECRET!,
  },
  body: JSON.stringify({ customerEmail, customerName, courseLink }),
});

// Reject newlines at the schema level
const emailFieldSchema = z.string().max(200).regex(/^[^\r\n]*$/, 'No line breaks allowed');

// AND defensively strip at the email-sending boundary, so a bypass anywhere
// upstream still can't inject headers
function sanitizeHeaderValue(value: string): string {
  return value.replace(/[\r\n]/g, '');
}

Audit this repository for unauthenticated or under-authenticated API endpoints.

For every API route handler (Express routes, Next.js API routes/route handlers,
Vercel serverless functions, or equivalent in this stack), check:

1. Does it require a verified session, JWT, or API token before doing anything
   state-changing (write, email send, external API call)? Flag any handler that
   doesn't check auth before its first side effect.

2. Does it derive user identity (userId, email, role) from a verified
   session/token, or does it trust `userId`/`email`/`role` fields from the
   request body/query string? Flag the latter — that's an impersonation bug.

3. For any endpoint that is only ever supposed to be called by our own backend
   (e.g. a webhook handler calling an internal email/notification endpoint),
   confirm there's a shared-secret check using a constant-time comparison that
   FAILS CLOSED (rejects the request) if the secret env var is missing or
   unset. Flag any that fail open.

4. For any code that constructs raw email headers (From/To/Subject/Reply-To)
   by string interpolation, confirm every interpolated value is stripped of
   \r and \n and that the input schema also rejects line breaks. Flag any
   missing this.

For each finding, give me: the file and line, a one-line description of the
exploit, and a concrete fix using patterns already present elsewhere in this
codebase where possible. Do not fix anything yet — just report.