Skip to content

fix: secure unauthenticated ML endpoints (#537)#548

Open
Suyash2527 wants to merge 1 commit into
neeru24:mainfrom
Suyash2527:fix/auth-bypass-537
Open

fix: secure unauthenticated ML endpoints (#537)#548
Suyash2527 wants to merge 1 commit into
neeru24:mainfrom
Suyash2527:fix/auth-bypass-537

Conversation

@Suyash2527
Copy link
Copy Markdown

What does this PR do?

This PR secures three resource-intensive routes (/comparison, /api/analyze, and /api/explain) that were missing authentication decorators, preventing unauthenticated users from bypassing login and consuming GPU/CPU time and AI API quota.

Related Issue

Closes #537

Changes made

  • Created an @api_login_required decorator that returns a proper JSON 401 Unauthorized response for unauthenticated API requests instead of an HTML redirect.
  • Protected the /comparison route using the standard Flask-Login @login_required decorator.
  • Protected the /api/analyze and /api/explain routes using the new @api_login_required decorator.

Checklist

  • I have tested my changes
  • My code follows project guidelines
  • No new errors introduced

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 1, 2026

Thanks for creating a PR for your Issue! ☺️

We'll review it as soon as possible.
In the meantime, please double-check the file changes and ensure that all commits are accurate.

If there are any unresolved review comments, feel free to resolve them. 🙌🏼

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: /comparison, /api/analyze, and /api/explain Missing @login_required — Unauthenticated ML Inference Possible

1 participant