Review server authorization for auth-sensitive Nuxt API routes

This opt-in rule requires a doctor.config.ts that registers createNuxtAuthorizationReviewExtension. See the Nuxt authorization review setup before running it.

Run this rule

pnpm vite-doctor . --framework nuxt --config doctor.config.ts --rules nuxt/review/api-authorization-coverage

Why it matters

Nuxt app route middleware runs during app navigation and cannot authorize a direct server API request.

Recommended fix

Verify the server guard and enforce authorization in the handler or server middleware.

Useful links

• Rule reference
• Nuxt routing

Example

Authorize the server request

Before

export default defineEventHandler(() => ({ private: true }))

After

export default defineEventHandler(async (event) => { await requireUserSession(event); return { private: true } })