#18 PR introduces a new middle ware isAdmin() that proceeds only if the user is an authenticated and is an admin. It was made initially to decide if the user should be able to view the admin page or not. However in the backend, endpoints like /api/experiences/verify/ and /api/experiences/delete are public endpoints with no check for auth or admin status.
This issue recommends adding the isAdmin() middleware to all sensitive endpoints to prevent security issues. Note: this issue is to just reiterate the 'CRITICAL' footnote in #18
#18 PR introduces a new middle ware
isAdmin()that proceeds only if the user is an authenticated and is an admin. It was made initially to decide if the user should be able to view the admin page or not. However in the backend, endpoints like/api/experiences/verify/and/api/experiences/deleteare public endpoints with no check for auth or admin status.This issue recommends adding the
isAdmin()middleware to all sensitive endpoints to prevent security issues. Note: this issue is to just reiterate the 'CRITICAL' footnote in #18