Skip to main content

Find Spring MVC handlers missing authorization

org.openrewrite.java.security.search.FindMissingSpringAuthorization

Flags Spring MVC (and WebFlux) controller methods reachable to anonymous users — either matched by permitAll() in a SecurityFilterChain / SecurityWebFilterChain bean (or in a legacy WebSecurityConfigurerAdapter.configure(HttpSecurity) override) or with no matching rule at all — and which do not carry an explicit authorization annotation (@PreAuthorize, @PostAuthorize, @Secured, @RolesAllowed, @PermitAll, @DenyAll), including annotations inherited from a superclass or overridden parent method. Detector only; does not modify code.

Tags​

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Used by​

This recipe is used as part of the following composite recipes:

Example​

Before​
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
class AccountController {
    @GetMapping("/account/{id}")
    public String show() {
        return "account";
    }
}
After​
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
class AccountController {
    @GetMapping("/account/{id}")
    public String /*~~(No authorization annotation and no matching SecurityFilterChain rule for `/account/{id}`)~~>*/show() {
        return "account";
    }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe FindMissingSpringAuthorization

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.32.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Missing authorization​

org.openrewrite.java.security.table.MissingAuthorization

Spring MVC handler methods reachable to anonymous users without an explicit authorization annotation.

Column NameDescription
Source pathThe path to the source file containing the handler method.
Controller classThe fully qualified name of the controller class.
Handler methodThe name of the handler method.
HTTP methodThe HTTP method served by the handler.
URL patternThe combined class- and method-level request mapping pattern.
ReasonWhy the handler is considered to be missing authorization.