Severity: 🟢 Low (authz footgun by omission)
Location
src/server/file-routes.ts:116-133.
Description
Action/HTML routes receive options.middlewares; the JSON loader endpoints receive a separate options.dataMiddlewares. A developer who protects mutations with middlewares: [auth] but forgets dataMiddlewares exposes every route's load() output as unauthenticated JSON at ${dataPath}<route>. Because the loader mirrors the same data an authenticated page would render, this is a plausible authorization bypass introduced by omission rather than by a framework bug.
Suggested fix
Default dataMiddlewares to middlewares when unset (with an explicit opt-out), or apply a single middlewares chain to both surfaces. At minimum, document prominently that both must be supplied.
Filed as part of a full-codebase security & correctness audit.
Severity: 🟢 Low (authz footgun by omission)
Location
src/server/file-routes.ts:116-133.Description
Action/HTML routes receive
options.middlewares; the JSON loader endpoints receive a separateoptions.dataMiddlewares. A developer who protects mutations withmiddlewares: [auth]but forgetsdataMiddlewaresexposes every route'sload()output as unauthenticated JSON at${dataPath}<route>. Because the loader mirrors the same data an authenticated page would render, this is a plausible authorization bypass introduced by omission rather than by a framework bug.Suggested fix
Default
dataMiddlewarestomiddlewareswhen unset (with an explicit opt-out), or apply a singlemiddlewareschain to both surfaces. At minimum, document prominently that both must be supplied.Filed as part of a full-codebase security & correctness audit.