From e4c9f0d7d6f78598ce99baffb4d23cef4ce3acb7 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 14 Sep 2026 07:29:33 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- .../app/api/favorites/route.js | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js b/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js index 4b6ebc0..0e106ae 100644 --- a/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js +++ b/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js @@ -8,6 +8,13 @@ export async function GET(request) { // we can safely access user data here const session = await getServerSession(); + if (!session?.user) { + return NextResponse.json( + { error: "Unauthorized - Please login to access this resource" }, + { status: 401 } + ); + } + // Return user's favorite tweets from localStorage // In a real app, this would fetch from a database return NextResponse.json({ @@ -20,6 +27,13 @@ export async function GET(request) { export async function POST(request) { const session = await getServerSession(); + if (!session?.user) { + return NextResponse.json( + { error: "Unauthorized - Please login to access this resource" }, + { status: 401 } + ); + } + try { const body = await request.json(); @@ -41,6 +55,13 @@ export async function POST(request) { export async function DELETE(request) { const session = await getServerSession(); + if (!session?.user) { + return NextResponse.json( + { error: "Unauthorized - Please login to access this resource" }, + { status: 401 } + ); + } + try { const { searchParams } = new URL(request.url); const tweetId = searchParams.get("tweetId");