AI-written Next.js 15.5.2 app: all 12 attacks worked

The write-up's test app is deliberately small: Next.js 15.5.2 on the App Router, React 19.1, TypeScript, SQLite via node:sqlite, and Node.js 22.22.0, with 17 source files amounting to 352 lines. Before fixes, all 12 attack tests succeeded; after fixes, all 12 were blocked. The tests ran only against a local copy and dummy data, and the author warns against trying them on a live server.

Several holes trace back to specific shortcuts. A profile-update form sent the target's userId in a hidden field, so changing it and adding role=admin let a logged-in Bob rename Alice and promote her; the fix reads the target from the session and accepts only the name. Route handlers had no auth or ownership check at all, so deleting other people's posts and reading drafts without logging in both worked, and a users API returned SELECT * output including plaintext passwords. The password fix uses scrypt with a salt and the settings N=2^15, r=8, p=3, which OWASP lists alongside the N=2^17, r=8, p=1 minimum as using about 32MiB per computation.

Other flaws were about what was never restricted: a search box and an ID parameter let SQL be embedded into queries; an image proxy fetched any URL handed to it (SSRF), a concern the author ties to private networks like Railway's *.railway.internal; uploads used the client-supplied file name, so ../../pwned.html was written outside public/uploads; CORS echoed the request Origin with credentials allowed; the post-login redirect followed an absolute URL to an external site; and the session cookie lacked HttpOnly, Secure, and SameSite with a one-year lifetime and a token made from Math.random(). The version pin also mattered — the author notes AI often writes the version it learned and misses later patches. After twelve app-specific Semgrep rules were written, 17 matches appeared before the fixes and 0 after, but the author cautions that this and the zero public-rule findings only mean no rule matched, not that the code is safe.