Assert For Auth Control (ARCH4133)

Key java.security.assert-for-auth-control · Severity warning · Category security · CWE CWE-617

Enforcing authorization with assert is unsafe: when the JVM runs with -da (assertions disabled), the expression never executes and the check is silently skipped. Always enforce security decisions through ordinary control flow.

Incorrect

public void deleteAccount(User user, Account account) {
    assert user.isAdmin() : "unauthorized"; // skipped under -da in production
    repository.delete(account);
}

Correct

public void deleteAccount(User user, Account account) {
    if (!user.isAdmin()) {
        throw new AccessDeniedException("unauthorized");
    }
    repository.delete(account);
}

Fix

Enforce authorization with an explicit if check and exception, not assert.