Description
In both backend/routes/tasks.routes.js and backend/routes/chat.routes.js, mutation routes are registered twice - first with authenticateUser and again with only the validate* middleware. Express uses the first registered handler, making the second registration silently dead code. More critically, DELETE /tasks/:id is registered twice — once WITH authenticateUser and once WITHOUT:
// tasks.routes.js
router.post("/", authenticateUser, createTask); // first registration (used)
router.delete("/:id", authenticateUser, deleteTask); // first registration (used)
// ...
router.post("/", validateTask, createTask); // dead code
router.delete("/:id", deleteTask); // dead code (no auth!)If the route registration order is ever changed by a future contributor, the DELETE /:id without authentication could become the active handler, allowing unauthenticated users to delete any task by ID.
To Reproduce
- Inspect the route file and verify the duplicate registrations.
- Swap the order of the two
router.delete lines.
- Send
DELETE /api/tasks/:id with no auth token.
- The task is deleted without authentication.
Expected Behavior
Each route should have exactly one registration that applies both middleware in the correct order:
router.get("/", authenticateUser, getTasks);
router.post("/", authenticateUser, validateTask, createTask);
router.patch("/:id", authenticateUser, validateTask, updateTaskStatus);
router.patch("/:id/edit", authenticateUser, validateTask, updateTask);
router.delete("/:id", authenticateUser, deleteTask);Apply the same consolidation to chat.routes.js.
Actual Behavior
Duplicate route registrations exist. The second DELETE /:id registration has no authentication middleware and is one registration-order change away from being exploited.
Desktop
- Backend: Node.js / Express
- Files:
backend/routes/tasks.routes.js, backend/routes/chat.routes.js
Additional context
Expected NSOC points: level2 (security - latent auth bypass risk from duplicate route registration)
Labels: bug, NSoC'26, level2
Checklist:
Description
In both
backend/routes/tasks.routes.jsandbackend/routes/chat.routes.js, mutation routes are registered twice - first withauthenticateUserand again with only thevalidate*middleware. Express uses the first registered handler, making the second registration silently dead code. More critically,DELETE /tasks/:idis registered twice — once WITHauthenticateUserand once WITHOUT:If the route registration order is ever changed by a future contributor, the
DELETE /:idwithout authentication could become the active handler, allowing unauthenticated users to delete any task by ID.To Reproduce
router.deletelines.DELETE /api/tasks/:idwith no auth token.Expected Behavior
Each route should have exactly one registration that applies both middleware in the correct order:
Apply the same consolidation to
chat.routes.js.Actual Behavior
Duplicate route registrations exist. The second
DELETE /:idregistration has no authentication middleware and is one registration-order change away from being exploited.Desktop
backend/routes/tasks.routes.js,backend/routes/chat.routes.jsAdditional context
Expected NSOC points: level2 (security - latent auth bypass risk from duplicate route registration)
Labels:
bug,NSoC'26,level2Checklist: