Token CRUD endpoints had no authentication guard. Without it, unauthenticated requests could reach the handler — GET would return empty results silently, and POST could attempt to insert a token with user_id = NULL. All other route files in this codebase apply requireAuth explicitly; tokens.js was simply missing it. |
||
|---|---|---|
| .. | ||
| src | ||
| .env.example | ||
| .gitignore | ||
| Dockerfile | ||
| package.json | ||