Harvester API route exposed without security filter

Answer the question first

To keep a Harvester route from being publicly reachable, authentication must be performed before any caching lookup, pagination must be understood as a per‑request limit that does not stop cumulative data harvesting, and a route becomes public when it is registered without an explicit security policy or when the global default policy is switched to allow anonymous access.

Likely explanation vs. confirmed facts

Confirmed facts (from the research)

• Harvester applies security filters only when they are explicitly registered; a route added without a filter inherits the global allow‑all policy and is publicly reachable.
• To enforce authentication before cache lookup, place an authentication middleware (e.g., JWT validator) ahead of any response‑caching middleware, or use a cache‑aside pattern where the cache key incorporates the caller’s principal or a token hash.
• Pagination limits the number of records per request but does not restrict the total number of requests; an unauthenticated client can iterate through pages to harvest the entire dataset. If the cache is shared across users and cache keys do not include user context, cached pages may be served without re‑checking authentication.
• A route transitions from authenticated to public access when it is registered via HarvesterConfig.AddRoute (or similar) without specifying a policy name, or when the global default policy in startup configuration is changed from RequireAuthenticated to AllowAnonymous. No direct admin change to that route is required.

Likely explanation (reasoning)

When authentication middleware is positioned after a caching layer, the cache may serve a response that was generated for an authenticated user to an unauthenticated request, because the cache key does not reflect the caller’s identity. Pagination does not mitigate this; each page request can be satisfied from the same cached entry, allowing an attacker to collect all data by repeated calls. Configuration drift occurs because the framework’s default posture is permissive; omitting a policy or relaxing the global default silently makes existing routes public.

Steps needed for this case

1. Verify that each route registration includes an explicit security policy reference (e.g., .RequireAuthentication() or a named policy).
2. Check middleware order: ensure authentication middleware appears before any response‑caching middleware in the pipeline.
3. If using a cache‑aside approach, confirm that the cache key incorporates a user‑specific token or that caching is disabled for endpoints that require authentication.
4. Review the global default policy in startup configuration; it should be set to require authentication unless a specific route is intentionally anonymous.
5. Enable request logging and send an unauthenticated request to the suspect endpoint; a 200 response with data confirms missing authentication.

One missing diagnostic detail

Do you have access to the Harvester startup code or configuration where routes are registered? Knowing whether the route was added with or without an explicit security policy will determine if the fix is to add a policy or to adjust the global default.