Authorization enforced only on frontend
Backend routes should enforce authorization directly instead of relying on frontend gating alone.
#Metadata
#Why it matters
Frontend checks are easy to bypass, so sensitive routes need server-side authorization on the backend path itself.
#Remediation
Add a backend authorization or permission check on the matching route handler.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.frontend-only-authorization.rule.yaml.