← Attack Surface Lab
Auth-Gated Endpoints
Code loaded for all users but guarded by role checks and token validation. The endpoints execute only for authenticated or privileged users — but the JavaScript ships to everyone.
01
Admin role check hides UI functions
Two admin functions guarded by window.currentUser.role !== 'admin'. The check prevents execution for non-admin users, but the code — including endpoint URLs and parameter names — is in every user's browser.
const adminApiBase = '/api/admin/users/';
const suspendUser = (userId, reason) => {
const user = window.currentUser;
if (!user || user.role !== 'admin') return;
$.post(adminApiBase + 'suspend', {
userId: userId,
reason: reason
});
};
const resetUserPassword = (userId) => {
const user = window.currentUser;
if (!user || user.role !== 'admin') return;
$.post(adminApiBase + 'reset-password', {
userId: userId
});
};
02
localStorage token gate hides premium feature
Premium analytics are loaded only when localStorage.getItem('auth_token') returns a value. Without a valid session, the function returns early. The analyzer reads through the guard and discovers the endpoint — including the Authorization: Bearer header pattern.
const loadPremiumAnalytics = async () => {
const token = localStorage.getItem('auth_token');
if (!token) return;
await fetch('/api/premium/analytics', {
method: 'GET',
headers: {
'Authorization': 'Bearer ' + token,
'Content-Type': 'application/json'
}
});
};
loadPremiumAnalytics();