Authorization removed (ARCH8203)

Key kotlin.security.authorization-removed · Severity error · Category security · CWE CWE-862

Merge requests only. Compares each changed endpoint with its version on the target branch and flags one that became less protected: on Spring controllers a @PreAuthorize, @PostAuthorize, @Secured or @RolesAllowed removed from the handler or its class, or @PermitAll / permitAll() added; in the Spring Security configuration a path newly given permitAll() or newly ignored; on Ktor a route that ran inside authenticate { } and no longer does (moved out, the block made optional, or its Route function no longer called inside one). The repository’s own annotations that carry one of Spring’s are recognised; names of this project are not. An open endpoint on its own is not a finding; the change that opened it is, and an endpoint the change itself added is new, not opened.

Incorrect

@RestController
@RequestMapping("/orders")
class OrderController(private val orders: OrderService) {
    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/{id}")
    fun delete(@PathVariable id: Long) = orders.delete(id)
}

Correct

@RestController
@RequestMapping("/orders")
class OrderController(private val orders: OrderService) {
    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/{id}")
    fun delete(@PathVariable id: Long) = orders.delete(id)
}