FeathersJS service exposes data publicly when authentication before hook is omitted

Direct Answers

1. Does the authentication middleware guarantee params.user is defined only for authenticated requests? Yes. The @feathersjs/authentication middleware (or the authenticate() hook) sets params.user only after successful token validation. When validation fails or no token is provided, params.user remains undefined.

2. If a validation hook runs after a service-method hook, can data leak? Yes. Hooks execute in registration order. A before hook that fetches data (e.g., a custom find hook) registered before the authentication check will run and return data to an unauthenticated client.

3. Minimal configuration to enforce authentication on every sensitive service? Register the authentication middleware globally, then add a single shared before hook on app.all (or each service's all method) that throws when params.user is falsy. This hook must be registered before any other before hooks that access data.

Why Hook Order Matters

FeathersJS processes before hooks sequentially. The authentication check must be the first before hook so it can short-circuit the chain. Example of correct ordering:

// app.js or a central hooks file
const { authenticate } = require('@feathersjs/authentication').hooks;
const { iff, isProvider } = require('feathers-hooks-common');

// 1. Global authentication middleware (Express/Koa)
app.configure(authentication());

// 2. Shared guard hook — runs before ANY service method
app.hooks({
  before: {
    all: [
      authenticate('jwt'),          // sets params.user or throws 401
      // other global before hooks go AFTER this line
    ],
  },
});

// 3. Service-specific hooks (if any) register AFTER the guard
app.service('messages').hooks({
  before: {
    find: [someDataHook],           // safe: runs only after auth passes
  },
});

If you instead write:

app.service('messages').hooks({
  before: {
    find: [someDataHook, authenticate('jwt')], // DANGEROUS: dataHook runs first
  },
});

…an unauthenticated request executes someDataHook and receives data before the 401 is thrown.

Verification Steps

1. Send a request to a protected endpoint without an Authorization header. Expect HTTP 401 and an empty response body.
2. Add temporary logging in the guard hook: console.log('auth check', !!context.params.user). Confirm it logs false for unauthenticated requests.
3. Temporarily move the guard hook after a data-fetching hook; observe that data is returned, proving ordering matters.
4. Write unit tests that mock the authentication middleware to return a user object and undefined, asserting the service behaves correctly in both cases.

One Diagnostic Detail

Are you using the built-in authenticate() hook, a custom guard, or a third-party authentication strategy? The exact hook name changes the registration snippet but not the ordering principle.