Review session and API-key boundaries | DevPrompt Lab

Verify that credential type, CSRF, role, and ownership checks match endpoint intent.

prompt · Security · advanced

English Tiếng Việt

A narrow authentication review for concrete endpoints that preserves the existing login architecture.

Reusable content

Review the listed endpoints against their intended credential types. Trace session cookies and API keys separately. Check CSRF on cookie-authenticated mutations, session expiry, role and second-factor requirements for admin actions, owner scoping, and safe unauthenticated responses. Confirm that an API key cannot silently inherit browser-only privileges. Report only verified mismatches and preserve existing login behavior where safe. Recommend the smallest guard correction and tests for each credential type.

Endpoints: {{ENDPOINTS}}

Credential types: {{CREDENTIAL_TYPES}}

Policy: {{POLICY}}

CSRF handling: {{CSRF}}

How to use it

Inspect the actual middleware and endpoint calls; do not infer protection from route names.

Example

Test: valid browser session may save a resource; valid API key is rejected with SESSION_REQUIRED if this action is browser-session-only.