Description
POST /api/risk-score/recalculate triggers a full batch recalculation of risk scores for all subscriptions across all users. It is protected only by the standard authenticate middleware (any logged-in user), not the adminAuth middleware.
The route file contains the comment // TODO: Add admin check but it has never been implemented.
Risk
Any authenticated user (including free-tier users) can repeatedly POST to this endpoint, causing the backend to:
- Fetch all subscriptions from the database in pages of 100
- Run sequential risk calculations on each one
- Write updated risk scores back to the database
This is a denial-of-service attack surface that can degrade database performance and backend responsiveness for all users.
Fix
// Add adminAuth middleware to the route
router.post('/recalculate', authenticate, adminAuth, async (req, res) => {
// ...existing implementation
});Or alternatively, move the recalculation endpoint to the /api/admin router which already uses adminAuth.
Additional Steps
Description
POST /api/risk-score/recalculatetriggers a full batch recalculation of risk scores for all subscriptions across all users. It is protected only by the standardauthenticatemiddleware (any logged-in user), not theadminAuthmiddleware.The route file contains the comment
// TODO: Add admin checkbut it has never been implemented.Risk
Any authenticated user (including free-tier users) can repeatedly POST to this endpoint, causing the backend to:
This is a denial-of-service attack surface that can degrade database performance and backend responsiveness for all users.
Fix
Or alternatively, move the recalculation endpoint to the
/api/adminrouter which already usesadminAuth.Additional Steps