[Bug] Protected routes accessible without authentication

[joshnajojo12]

Description

Unauthenticated users are able to access protected routes such as the dashboard by directly entering the URL in the browser. This bypasses the expected authentication flow and allows access without logging in.

This indicates that authentication checks are not properly enforced for certain routes.

Goals

• Ensure protected routes require authentication
• Prevent unauthenticated access to dashboard routes
• Improve security of route handling
• Ensure consistent authentication checks across all protected endpoints
• Improve reliability of user access control

Expected Outcome

If a user tries to access protected routes such as /dashboard or /register/interests without logging in, the system should redirect the user to the login page.

Protected pages should only be accessible after successful authentication and verification of the user session or token.

Acceptance Criteria

• Unauthenticated users cannot access protected routes
• Users attempting to access protected URLs are redirected to the login page
• Authentication middleware validates session/token before loading protected pages
• Unauthorized requests return proper authentication error responses
• All protected endpoints enforce authentication consistently

Implementation Details

Authentication checks should be enforced at the backend level using middleware or route guards to verify that the user has a valid session or authentication token before granting access to protected endpoints such as /dashboard.

Mockups / Wireframes

Not applicable

---

Product Name

MuLearn

Project Name

Protected Route Authentication Validation

Tech Skills Needed:

Backend Development, Authentication Handling, API Security

Mentor(s)

N/A

Complexity

Medium

Category

Bug, Security

Sub Category

Backend, API, Reproducible