Protecting Auth Middleware: VS Code Copilot and Route Guard Removal

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is debugging a CORS preflight error on an API route. To isolate the issue, it removes the authentication middleware call:

// Before
router.use('/api/admin', authMiddleware, adminRoutes);

// After — middleware removed
router.use('/api/admin', adminRoutes);

SSG catches the write — removing auth middleware exposes admin routes to unauthenticated requests.

# illustrative sample output
[BLOCK] write › src/routes/admin.ts — rule: no-auth-middleware-removal

Give SSG context

SSG evaluates VS Code Copilot's file write calls via the SSG MCP Server integration.

Required context

rule no-auth-middleware-removal {
  enabled true
  priority 100
  severity error
  DENY write
  IF path MATCHES ".*(routes|router|api).*\.(ts|js)$"
  AND content CONTAINS "router.use"
  AND NOT content CONTAINS "authMiddleware"
  AND NOT content CONTAINS "authenticate"
  AND NOT content CONTAINS "verifyToken"
  MESSAGE "Route file missing authentication middleware. Verify that all protected routes have auth guards."
}

Optional context

Flag when auth-related imports are removed from route files:

rule detect-auth-import-removal {
  enabled true
  priority 90
  severity error
  DENY write
  IF path MATCHES ".*routes.*\.(ts|js)$"
  AND NOT content CONTAINS "auth"
  AND NOT content CONTAINS "middleware"
  MESSAGE "Route file has no authentication references. Confirm this route is intentionally public."
}

What SSG does

SSG checks the file content at write time. The middleware removal is blocked before it's saved — no unauthenticated window is opened on your API.

Ask the agent to fix CORS without removing auth

Auth middleware removal was blocked. Fix CORS without removing authentication:
  // Option 1: Add CORS before auth middleware
  router.use(cors({ origin: allowedOrigins }));
  router.use('/api/admin', authMiddleware, adminRoutes);

  // Option 2: Handle OPTIONS preflight separately
  router.options('/api/admin/*', cors());
  router.use('/api/admin', authMiddleware, adminRoutes);
Never remove auth middleware to debug other issues — use per-route logging instead.

Test auth after any route change

After any routing change, run your authentication test suite:

curl -X GET https://api.example.com/api/admin/users
# Should return 401 Unauthorized, not 200

A 200 response to an unauthenticated request on a protected route is a critical finding.