🚀 Description
Currently, several backend API routes are publicly accessible without authentication or authorization checks. Sensitive operations like task deletion, task updates, analytics access, and chat actions can be performed by any user.
This creates a serious backend security vulnerability.
📍Affected Files
backend/routes/tasks.routes.jsbackend/routes/chat.routes.jsbackend/routes/feed.routes.jsbackend/routes/analytics.routes.js
❌ Current Problem
Routes are exposed directly without middleware protection.
Example:
router.delete("/:id", deleteTask);No authentication middleware is used before accessing protected routes.
✅ Expected Solution
- Add authentication middleware
- Validate logged-in users before route access
- Protect sensitive CRUD operations
- Add authorization checks where necessary
🎯 Expected Outcome
- Secured backend APIs
- Restricted access control
- Safer multi-user environment
🏷️ Expected Labels
level3 NSoC'26
🚀 Description
Currently, several backend API routes are publicly accessible without authentication or authorization checks. Sensitive operations like task deletion, task updates, analytics access, and chat actions can be performed by any user.
This creates a serious backend security vulnerability.
📍Affected Files
backend/routes/tasks.routes.jsbackend/routes/chat.routes.jsbackend/routes/feed.routes.jsbackend/routes/analytics.routes.js❌ Current Problem
Routes are exposed directly without middleware protection.
Example:
No authentication middleware is used before accessing protected routes.
✅ Expected Solution
🎯 Expected Outcome
🏷️ Expected Labels
level3NSoC'26