hunt-spa-api

Download every JS bundle referenced by the SPA's HTML shell, then grep for quoted resource route strings like "account/payment/list" rather than full URLs, since minifiers store routes as string segments. Also extract API hosts and versioned base paths, and reconstruct lazy-loaded chunk filenames from the chunk map in main.js.

First send an unauthenticated request to an endpoint you expect to be protected and record the correct 401 rejection as a control. Then request each discovered route with no Authorization header and compare: a 200 with data or a 400 business-logic validation error indicates the route processed your request without an auth check.

No. Frontend OAuth or SSO login says nothing about whether the backend API validates tokens on every route. Route groups frequently miss the auth middleware, so always test the API directly and unauthenticated regardless of how locked-down the login UI appears.

Minifiers store routes as concatenated string segments like "user/profile" rather than full /api/v1 URLs, so a naive base-path grep fails. Grep for quoted resource-word route strings instead and prepend the API base path yourself when testing.

Stop at minimum-necessary proof once a missing auth check is confirmed; do not enumerate or exfiltrate the dataset. Avoid write endpoints like create or signup as proof, verify the API host belongs to the in-scope target, and validate leaked keys before claiming they are exploitable secrets.