Unauthenticated writes on PUT /post/:id/views and PUT /publish/:id (orm/express)

Open Beginner friendly
#8,560 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
68/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Quiet
Tech stack
express, typescript
Domain
api, authentication, backend, security

Research direction

Read orm/express/src/index.ts and inspect the PUT /post/:id/views and PUT /publish/:id handlers. Confirm whether the warning belongs beside the handlers or in the README, then add a concise note that these writes lack authentication or ownership checks; done means the limitation is clearly documented.

Written by the indexing model from the issue text.

Description

In orm/express/src/index.ts, both write endpoints take :id straight from the URL and mutate the Post row with no authentication or ownership check:

app.put('/post/:id/views', async (req, res) => {
  const { id } = req.params
  const post = await prisma.post.update({
    where: { id: Number(id) },
    data: { viewCount: { increment: 1 } },
  })
  // ...
})

app.put('/publish/:id', async (req, res) => {
  const { id } = req.params
  // ...
  const post = await prisma.post.update({
    where: { id: Number(id) },
    data: { published: !postData?.published },
  })
})

Anyone who can reach the API can inflate the view count or toggle published on any post by guessing an integer id — there's no caller-identity check anywhere on either path.

I get that this is an intentionally minimal teaching example and auth is out of scope for the "getting started" story — not filing this as a "this repo is broken," more as a heads-up: this example is widely copied into real projects, and this specific gap (writes gated by nothing but a URL param) is one people tend to carry over verbatim. A one-line comment near these two handlers (// no auth check here — add one before shipping this to production) or a short note in the README might be enough to save someone a bad day.

Happy to send a small PR adding that comment / a minimal isOwner stub if useful — let me know which you'd prefer.

(Found while running an automated behavior-proof tool — SPARDA — against a corpus of public Express repos; happy to share the full report if useful.)

Dominant language
TypeScript
Stars
6.7k
Forks
1.5k
Avg merge
5d 16h
Merged PRs (30d)
24

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from prisma/prisma-examples

All issues in prisma/prisma-examples

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.