Unauthenticated Endpoint

Reports HTTP endpoints that declare no authentication requirement. The endpoint inventory carries each endpoint’s authentication evidence (annotations, middleware chain, OpenAPI security: block, framework-level filters); when none of those are present, and the endpoint’s path is not in the allowlist of legitimately public routes (/health, /metrics, /actuator/, /.well-known/, …), the endpoint is flagged.

This is the canonical OWASP API2:2023 — Broken Authentication signal at the endpoint-shape level.

An endpoint that does not require authentication is reachable by any client on the network, with no audit trail tied to a user identity. For endpoints handling business data this is a direct path to enumeration, scraping, abuse, and data exfiltration — every public, unauthenticated finding is reachable from the internet the moment the service is exposed.

Unauthenticated endpoints often slip in unintentionally — a missing @PreAuthorize, a route added before the auth middleware was registered, a removed annotation during a refactor, an OpenAPI spec where the global security: was overridden to security: [] for a single operation and never restored. Static endpoint review is the only reliable way to surface them before a release.

Add an authentication requirement at the endpoint, controller, or service level using the framework’s standard mechanism — annotation, middleware, OpenAPI security: block, or a global filter that denies-by-default and only allow-lists explicit public routes.

If the endpoint is genuinely public (health checks, marketing landing pages, OAuth callback URLs, …), add its path to the detector’s publicPaths allowlist so the finding stops firing.

The detector accepts one configurable parameter:

Unless your project has additional well-known public paths, you typically do not need to configure this detector.