René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][server] File-route loader dataMiddlewares separate from middlewares → auth-bypass footgun","articleBody":"## Severity: 🟢 Low (authz footgun by omission)\n\n## Location\n[`src/server/file-routes.ts:116-133`](../blob/main/src/server/file-routes.ts#L116-L133).\n\n## Description\nAction/HTML routes receive `options.middlewares`; the JSON loader endpoints receive a **separate** `options.dataMiddlewares`. A developer who protects mutations with `middlewares: [auth]` but forgets `dataMiddlewares` exposes every route's `load()` output as **unauthenticated JSON** at `${dataPath}\u003croute\u003e`. Because the loader mirrors the same data an authenticated page would render, this is a plausible authorization bypass introduced by omission rather than by a framework bug.\n\n## Suggested fix\nDefault `dataMiddlewares` to `middlewares` when unset (with an explicit opt-out), or apply a single `middlewares` chain to both surfaces. At minimum, document prominently that both must be supplied.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:53.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/181/bQuery/issues/181"}