v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.express.auth-middleware-noop

An authentication/authorization middleware does nothing but call next().

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

A guard whose entire body is next() (or return next()) authorises every request, so any route it protects is effectively public. This is the classic "stubbed out for now" middleware that ships to production and silently removes access control.

Implement the check: verify the session/token, and either call next() on success or short-circuit with res.status(401).end() / res.status(403).end() (or next(err)) when it fails. If a route is meant to be public, remove the guard entirely rather than leaving a no-op that reads as protected.

VULNERABLE
vulnerable.ts
import express from 'express';

const app = express();

// ruleid: auth.express.auth-middleware-noop
function requireAuth(req, res, next) {
  next();
}

// ruleid: auth.express.auth-middleware-noop
function ensureAuthenticated(req, res, next) {
  return next();
}

// ruleid: auth.express.auth-middleware-noop
const isLoggedIn = (req, res, next) => next();

// ruleid: auth.express.auth-middleware-noop
const checkAuth = (req, res, next) => {
  next();
};

// ruleid: auth.express.auth-middleware-noop
const protectRoute = (req, res, next) => {
  return next();
};

// ruleid: auth.express.auth-middleware-noop
const authGuard = function (req, res, next) {
  next();
};

app.get('/admin', requireAuth, (req, res) => res.send('secret'));
SAFE
safe.ts
import express from 'express';

const app = express();

// ok: auth.express.auth-middleware-noop -- real guard: it inspects the request
function requireAuth(req, res, next) {
  if (!req.session?.user) {
    return res.status(401).end();
  }
  next();
}

// ok: auth.express.auth-middleware-noop -- real guard as an arrow function
const ensureAuthenticated = (req, res, next) => {
  if (!req.user) return res.status(403).end();
  return next();
};

// ok: auth.express.auth-middleware-noop -- not an auth guard (logging pass-through)
const requestLogger = (req, res, next) => next();

// ok: auth.express.auth-middleware-noop -- error handler (4 args), not an auth guard
function errorHandler(err, req, res, next) {
  next(err);
}

app.get('/admin', requireAuth, (req, res) => res.send('secret'));

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.express.auth-middleware-noop -- <reason>

References

https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html ↗https://cwe.mitre.org/data/definitions/287.html ↗