### Authentication Operation Key Check Items

Look for short circuits and missing permissions.

- **Missing permission validation**: Route interfaces have no permission validation logic at all.
- **Validation failure does not block execution**: In branches where authentication fails or the token is invalid, check if the code only logs, outputs error messages, or reassigns to create a token/session, but **does not write `return` or `raise` to completely block the execution flow**, causing subsequent sensitive code to continue executing (short-circuit defect).
- **Hardcoded credential bypass**: Credentials used for identity validation, signing, or encryption are directly defined as fixed values in the code, allowing subsequent authentication credentials to be forged.
- **Privilege logic bypass**: The permission validation code contains "shortcuts", "privilege whitelists", or "debug backdoors" in the authorization logic.
- **Multi-step authentication bypass**: Review multi-step operations (such as password recovery flow: 1. Verify phone -> 2. Enter verification code -> 3. Reset password) where critical steps rely solely on frontend-passed parameters (e.g., `step=3`) to determine the execution flow, without strong backend validation that the user has completed the preceding steps (logic jump vulnerability).
- **Trusting frontend credentials**: Check for risks in identity validation logic where easily forged frontend input is blindly trusted (e.g., unsigned plaintext cookies like `isLogin=true` or request header identifiers).
- **Missing rate limiting**: In username/password login scenarios, where user input attempts are not limited and no CAPTCHA mechanism is added, attackers can attempt arbitrary numbers of username/password combinations (leading to password brute-force attacks).
