v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.java.web.permit-all-actuator

Spring Security grants permitAll() to a sensitive management path.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Spring Boot Actuator and similar diagnostic endpoints expose health, environment, configuration, thread dumps, and heap dumps. Opening them to anonymous access leaks secrets and internal state and can enable remote code execution (CWE-862, broken access control). This is a common AI-generated mistake: the management path is opened to "fix" a probe or scrape and the intended authentication is never added.

Require authentication for management endpoints (e.g. requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ADMIN")) and expose only /actuator/health (and /info) publicly if you must.

VULNERABLE
vulnerable.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    // Spring Security 6 lambda DSL: actuator opened to anonymous access.
    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.permit-all-actuator
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/actuator/**").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }

    // Legacy antMatchers: heap dump endpoint left public.
    SecurityFilterChain legacy(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.permit-all-actuator
        http.authorizeRequests().antMatchers("/actuator/heapdump").permitAll();
        return http.build();
    }
}
SAFE
safe.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    // Management endpoints require authentication; only ordinary public routes
    // are opened.
    SecurityFilterChain secured(HttpSecurity http) throws Exception {
        // ok: auth.java.web.permit-all-actuator
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/actuator/**").hasRole("ADMIN")
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }

    // True-negative trap: permitAll() on a normal application path that is not a
    // management/diagnostics surface.
    SecurityFilterChain publicRoute(HttpSecurity http) throws Exception {
        // ok: auth.java.web.permit-all-actuator
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/login").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.web.permit-all-actuator -- <reason>

References

https://docs.spring.io/spring-boot/reference/actuator/endpoints.html ↗https://cwe.mitre.org/data/definitions/862.html ↗