Missing authorization (ARCH320)

Key dotnet.security.missing-authorize · Severity warning · Category security · CWE CWE-862

An API endpoint exposed without authorization lets unauthenticated users reach protected operations. Enforce access control explicitly.

Incorrect

[ApiController]
[Route("api/v1/orders")]
public class OrdersController : ControllerBase
{
    [HttpGet] public IActionResult GetAll() => Ok(_orders.All());
}

Correct

[ApiController]
[Authorize]
[Route("api/v1/orders")]
public class OrdersController : ControllerBase
{
    [HttpGet] public IActionResult GetAll() => Ok(_orders.All());
}

Fix

Add [Authorize] to controllers (or apply a global fallback policy) and mark intentionally public endpoints with [AllowAnonymous].

Minimal APIs

A mapping with no RequireAuthorization on it or its MapGroup, no [Authorize] on its handler and no AllowAnonymous is open. The rule reports it only when the application authorizes other endpoints and has no FallbackPolicy requiring a signed-in user, once per declaring type, naming the open routes. Your own extension that calls RequireAuthorization (for example .RequireApiKey("partner")) counts as protection; a .Produces(StatusCodes.Status401Unauthorized) declaration does not - it documents a check, it does not run one.

// Incorrect
app.MapGet("/verificationunits/list", HandleAsync);

// Correct
app.MapGet("/verificationunits/list", HandleAsync).RequireAuthorization("devices");
app.MapGet("/health", () => "ok").AllowAnonymous();