fix: add authentication check in accounts.js (CWE-287)

[anupamme]

API endpoints in functions/api/accounts.js and functions/api/streams/live_inputs/index.js accept requests without any authentication validation. The code merely extracts the Authorization header from the incoming request and passes it to the Cloudflare API, but there is no validation that the request itself is authenticated. Any unauthenticated attacker can call these endpoints directly. The affected code is functions/api/accounts.js:27. This change is the fix I would apply.

Reference: CWE-287

What changed

• functions/api/accounts.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

const { handleRequest } = require("./functions/api/accounts.js");

describe("accounts endpoint requires valid authentication", () => {
  const payloads = [
    { name: "missing_auth", headers: { get: () => null } },
    { name: "empty_auth", headers: { get: () => "" } },
    { name: "invalid_token", headers: { get: () => "Bearer invalid_token_xyz" } },
  ];

  test.each(payloads)("rejects unauthenticated request: $name", async ({ name, headers }) => {
    const mockRequest = { headers };
    
    const response = await handleRequest(mockRequest);
    
    expect(response.status).toBe(401);
  });
});

---

Automated security fix by OrbisAI Security

[github-actions]

Before PRs are approved the project owner will need to review all changes. Note the CONTRIBUTING.MD