Flask route with no auth-style decorator

What it detects

Flask route with no auth-style decorator: an authentication check run by the semgrep analyzer.

Evidence

The Semgrep source location, rule identity, and bounded match context normalized into Fendix evidence.

Remediation

Flask route has no auth-style decorator (@login_required, @requires_auth, @jwt_required, or @auth.login_required) directly below the @app.route(...) line. Confirm authentication is enforced. The auth decorator must sit below @app.route(...), because route() must be the outermost decorator: one placed above @app.route(...) does not protect the route.

Limitations

This check is limited to the applicability and evidence delivered by semgrep. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions