fix(security): deny unauthenticated access by default#326
Conversation
The authorization chain listed specific paths and ended without a final rule, so any request matching none of the rules was permitted. Most /api endpoints matched no rule and relied entirely on method-level annotations, so any endpoint missing an annotation was reachable without authentication. Add an explicit allow list for the endpoints that must remain public (sign-in and its OAuth callbacks, registration, account and password recovery, the contact form, the public home, news, library and preview content, and the bootstrap configuration) and require authentication for every other request, so a missing method annotation fails closed.
Denying unmatched requests by default also caught the static asset paths served by the resource handlers configured in WebConfig (portal scripts, themes and translations, the runtime engine, project files and project icons). Those are public content that the login page and the anonymous project preview need, so blocking them would break sign-in and preview for signed-out visitors. Permit those paths explicitly. Student uploaded files are intentionally left requiring authentication.
7b07285 to
2c1ac6d
Compare
|
This is the default-deny follow-up from the #322 discussion (the missing terminal rule). Rebased onto develop now that #322 is merged, so it sits on top of the mvcMatchers admin rules rather than the old block. It adds I audited the public surface against the front-end to build the whitelist. One endpoint needed adding beyond the obvious set: Two paths that were reachable under permit-by-default become login-only here, and I left them that way on purpose since neither looks intended to be public: Authorization test coverage for this boundary is in #331, since it stands on its own and also guards the #322 rules. |
1 participant
Summary
The security configuration had no default-deny rule, so any request that did not match a specific rule was permitted. Endpoints were therefore exposed unless someone remembered to restrict them explicitly. This denies unmatched requests by default and adds an explicit allowlist of the endpoints that must stay public.
Changes
anyRequest().authenticated()as the final rule, with an allowlist of the genuinely public endpoints: sign-in and its OAuth callbacks, account registration, account and password recovery, the contact form, the public home, news, library and preview content, and the application bootstrap configuration.Why this is a draft
This changes runtime access for every path that does not match an explicit rule, so it needs verification on a running instance before merging:
Testing
mvnw package).