Plugin: lambda-securityRules
no-missing-authorization-check
Security rule for lambda-security. This rule is part of eslint-plugin-lambda-security and provides LLM-optimized error messages.
This rule is part of eslint-plugin-lambda-security.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Warning (security) |
| Auto-Fix | ❌ No auto-fix |
| Category | Security |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
Rule Details
This rule helps enforce secure coding practices for lambda-security applications.
Examples
❌ Incorrect
// Lambda handler performs a privileged operation without checking caller identity
export const handler = async (event) => {
await db.query('DELETE FROM users');
};✅ Correct
// Verify authorization before performing sensitive operations
export const handler = async (event) => {
const user = event.requestContext?.authorizer?.claims;
if (!user?.sub) {
return { statusCode: 403, body: 'Forbidden' };
}
await db.query('DELETE FROM users WHERE id = $1', [user.sub]);
};Configuration
{
rules: {
'lambda-security/no-missing-authorization-check': 'warn'
}
}⚙️ Options
| Option | Type | Default | Description |
|---|---|---|---|
allowInTests | boolean | true | Allow missing auth in test files |
handlerPatterns | string[] | [] | Handler file patterns to check |
Use this rule
npm install -D oxlint-plugin-lambda-security{ "jsPlugins": ["oxlint-plugin-lambda-security"], "rules": { "lambda-security/no-missing-authorization-check": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-lambda-security'], rules: { 'lambda-security/no-missing-authorization-check': 'error', }, },});oxlint-plugin-lambda-security re-exports eslint-plugin-lambda-security/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.