v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.java.web.permit-all

Spring Security authorizes every request without authentication via anyRequest().permitAll().

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

Because anyRequest() is the catch-all matcher, this makes the entire application publicly accessible. Any endpoint, including state-changing and sensitive ones, can be reached without a logged-in user (CWE-862, broken access control). This is a common AI-generated Spring mistake: the default-allow line is pasted in to "make it work" and the intended access rules are never added.

Require authentication by default with anyRequest().authenticated(), and open only the specific public routes explicitly, e.g. requestMatchers("/public/**").permitAll(). Granting permitAll() on a specific matcher is fine; granting it on anyRequest() is not.

VULNERABLE
vulnerable.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.permit-all
        http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
        return http.build();
    }

    SecurityFilterChain fluent(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.permit-all
        http.authorizeHttpRequests().anyRequest().permitAll();
        return http.build();
    }

    SecurityFilterChain legacy(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.permit-all
        http.authorizeRequests().anyRequest().permitAll();
        return http.build();
    }
}
SAFE
safe.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain secured(HttpSecurity http) throws Exception {
        // ok: auth.java.web.permit-all
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
        return http.build();
    }

    SecurityFilterChain publicRoutesThenAuth(HttpSecurity http) throws Exception {
        // ok: auth.java.web.permit-all
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/login").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }

    SecurityFilterChain fluentSecured(HttpSecurity http) throws Exception {
        // ok: auth.java.web.permit-all
        http.authorizeHttpRequests()
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated();
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.web.permit-all -- <reason>

References

https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html ↗https://cwe.mitre.org/data/definitions/862.html ↗