HIGH AI PREVALENCE: HIGH auth.java.web.wildcard-permit-all

Spring permits every request via a catch-all matcher.

CWE-862 OWASP A01:2021 java

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

The /** matcher matches every path, so granting it permitAll() makes the whole application reachable without authentication, including state-changing and sensitive endpoints (CWE-862, broken access control). This is a common AI-generated Spring mistake: a wide-open matcher is pasted in to "make it work" and the intended access rules are never added.

Open only the specific public routes explicitly, e.g. requestMatchers("/public/**").permitAll(), and require authentication by default with anyRequest().authenticated(). Granting permitAll() on a scoped path is fine; granting it on /** is not.

VULNERABLE

vulnerable.java

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.wildcard-permit-all
        http.authorizeHttpRequests(auth -> auth.requestMatchers("/**").permitAll());
        return http.build();
    }

    SecurityFilterChain legacyAnt(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.wildcard-permit-all
        http.authorizeRequests().antMatchers("/**").permitAll();
        return http.build();
    }

    SecurityFilterChain legacyMvc(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.wildcard-permit-all
        http.authorizeRequests().mvcMatchers("/**").permitAll();
        return http.build();
    }
}

SAFE

safe.java

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain scoped(HttpSecurity http) throws Exception {
        // ok: auth.java.web.wildcard-permit-all -- scoped public path, then authenticate the rest
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }

    SecurityFilterChain scopedLegacy(HttpSecurity http) throws Exception {
        // ok: auth.java.web.wildcard-permit-all -- scoped asset path is not the "/**" wildcard
        http.authorizeRequests()
            .antMatchers("/assets/**").permitAll()
            .anyRequest().authenticated();
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.web.wildcard-permit-all -- <reason>

References

https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html ↗https://cwe.mitre.org/data/definitions/862.html ↗