Authorization removed (ARCH344)

Key dotnet.security.authorization-removed · Severity error · Category security · CWE CWE-862

Merge requests only. Compares each changed endpoint with its version on the target branch and flags one that became less protected: on controllers an [Authorize] or custom guard removed, an [AllowAnonymous] added, a role, policy or permission dropped, or a base class that carried the authorization left; on minimal APIs a RequireAuthorization removed or narrowed (on the mapping, its MapGroup or its handler) or AllowAnonymous added; on FastEndpoints AllowAnonymous added or Roles/Policies/Permissions/Claims dropped. An open endpoint on its own is not a finding here; the change that opened it is. Under a global or fallback authorization policy, removing a plain [Authorize] changes nothing and is not reported.

Incorrect

[ApiController]
[Route("api/orders")]
public class OrdersController : ControllerBase
{
    [Authorize(Policy = "orders.delete")]
    [HttpDelete("{id}")]
    public IActionResult Delete(int id) => NoContent();
}

Correct

[ApiController]
[Route("api/orders")]
public class OrdersController : ControllerBase
{
    [Authorize(Policy = "orders.delete")]
    [HttpDelete("{id}")]
    public IActionResult Delete(int id) => NoContent();
}