POST /api/compare missing auth gate -- returns 500 instead of 401 #11

New Issue

TopherMayor · 2026-04-27T17:28:12Z

TopherMayor commented

2026-04-27 17:28:12 +00:00

Description

Unauthenticated POST requests to /api/compare return HTTP 500 instead of 401 Unauthorized.

Expected

POST /api/compare (no session) -> 401 Unauthorized

Actual

POST /api/compare (no session) -> 500 Internal Server Error

Fix

Add auth check at the top of the compare handler before attempting DB operations.

Severity: High - security + error handling.

## Description Unauthenticated POST requests to `/api/compare` return HTTP 500 instead of 401 Unauthorized. ## Expected ``` POST /api/compare (no session) -> 401 Unauthorized ``` ## Actual ``` POST /api/compare (no session) -> 500 Internal Server Error ``` ## Fix Add auth check at the top of the compare handler before attempting DB operations. ## Severity: High - security + error handling.

TopherMayor added the bug label 2026-04-27 17:28:12 +00:00

TopherMayor referenced this issue from a commit

2026-04-27 17:33:50 +00:00

fix #9 #10 #11: fix email_verified schema, add auth gate to compare, use real user id

TopherMayor closed this issue

2026-04-27 17:55:54 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TopherMayor/comparaison#11