# Route-Detect | Find Authentication (Authn) And Authorization (Authz) Security Bugs In Web Application Routes

**URL:** <https://onehack.st/t/route-detect-find-authentication-authn-and-authorization-authz-security-bugs-in-web-application-routes/274080>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, privacy\
**Created:** [February 1, 2024, 5:10pm UTC](https://onehack.st/t/route-detect-find-authentication-authn-and-authorization-authz-security-bugs-in-web-application-routes/274080 "2024-02-01T17:10:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [February 1, 2024, 5:10pm UTC](https://onehack.st/t/route-detect-find-authentication-authn-and-authorization-authz-security-bugs-in-web-application-routes/274080/1 "2024-02-01T17:10:57Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/2/924667cbb1d385586f050c9e996f9d534173883e.png)

# route-detect

[![CI](https://github.com/mschwager/route-detect/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/mschwager/route-detect/actions/workflows/ci.yml) [![Python Versions](https://camo.githubusercontent.com/b773027f925ab3bedc6fc66dca4d9aadec6f1c65880c5ef2c38d0532872a3d62/68747470733a2f2f696d672e736869656c64732e696f2f707970692f707976657273696f6e732f726f7574652d6465746563742e737667)](https://pypi.org/project/route-detect/) [![PyPI Version](https://camo.githubusercontent.com/43015038f0035f41cc8717068074a5102568cf70a8350f228cd3f166fcc847f4/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f726f7574652d6465746563742e737667)](https://pypi.org/project/route-detect/)

Find authentication (authn) and authorization (authz) security bugs in web application routes:

[![Routes demo](https://raw.githubusercontent.com/mschwager/route-detect/main/routes-demo.png)](https://raw.githubusercontent.com/mschwager/route-detect/main/routes-demo.png)

_Routes from `koel` streaming server_

Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severity of the issue:

- 2021 OWASP Top 10 #1 - [Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)
- 2021 OWASP Top 10 #7 - [Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/) (formerly Broken Authentication)
- 2023 OWASP API Top 10 #1 - [Broken Object Level Authorization](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)
- 2023 OWASP API Top 10 #2 - [Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)
- 2023 OWASP API Top 10 #5 - [Broken Function Level Authorization](https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/)
- 2023 CWE Top 25 #11 - [CWE-862: Missing Authorization](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)
- 2023 CWE Top 25 #13 - [CWE-287: Improper Authentication](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)
- 2023 CWE Top 25 #20 - [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)
- 2023 CWE Top 25 #24 - [CWE-863: Incorrect Authorization](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)

Supported web frameworks (`route-detect` IDs in parentheses):

- Python: Django (`django`, `django-rest-framework`), Flask (`flask`), Sanic (`sanic`)
- PHP: Laravel (`laravel`), Symfony (`symfony`), CakePHP (`cakephp`)
- Ruby: Rails\* (`rails`), Grape (`grape`)
- Java: JAX-RS (`jax-rs`), Spring (`spring`)
- Go: Gorilla (`gorilla`), Gin (`gin`), Chi (`chi`)
- JavaScript/TypeScript: Express (`express`), React (`react`), Angular (`angular`)

\*_Rails support is limited. Please see [this issue](https://github.com/mschwager/route-detect/issues/8) for more information._

# Installing

Use `pip` to install `route-detect`:

```auto
$ python -m pip install --upgrade route-detect

```

You can check that `route-detect` is installed correctly with the following command:

```auto
$ echo 'print(1 == 1)' | semgrep --config $(routes which test-route-detect) -
Scanning 1 file.

Findings:

  /tmp/stdin
     routes.rules.test-route-detect
        Found '1 == 1', your route-detect installation is working correctly

          1┆ print(1 == 1)

Ran 1 rule on 1 file: 1 finding.

```

# Using

`route-detect` provides the `routes` CLI command and uses [`semgrep`](https://github.com/returntocorp/semgrep) to search for routes.

Use the `which` subcommand to point `semgrep` at the correct web application rules:

```auto
$ semgrep --config $(routes which django) path/to/django/code

```

Use the `viz` subcommand to visualize route information in your browser:

```auto
$ semgrep --json --config $(routes which django) --output routes.json path/to/django/code
$ routes viz --browser routes.json

```

If you’re not sure which framework to look for, you can use the special `all` ID to check everything:

```auto
$ semgrep --json --config $(routes which all) --output routes.json path/to/code

```

If you have custom authn or authz logic, you can copy `route-detect`’s rules:

```auto
$ cp $(routes which django) my-django.yml

```

Then you can modify the rule as necessary and run it like above:

```auto
$ semgrep --json --config my-django.yml --output routes.json path/to/django/code
$ routes viz --browser routes.json

```

# Contributing

`route-detect` uses [`poetry`](https://python-poetry.org/) for dependency and configuration management.

Before proceeding, install project dependencies with the following command:

```auto
$ poetry install --with dev

```

## Linting

Lint all project files with the following command:

```auto
$ poetry run pre-commit run --all-files

```

## Testing

Run Python tests with the following command:

```auto
$ poetry run pytest --cov

```

Run Semgrep rule tests with the following command:

```auto
$ poetry run semgrep --test --config routes/rules/ tests/test_rules/

```

## GitHub:

> **[GitHub - mschwager/route-detect: Find authentication (authn) and authorization...](https://github.com/mschwager/route-detect)**
>
> Find authentication (authn) and authorization (authz) security bugs in web application routes.