cwe-306-missing-authentication

Fix missing authentication in Java by applying role-based access control using Spring Security annotations like @PreAuthorize and @AuthenticationPrincipal. These checks secure sensitive controller and service operations against unauthorized access.

Missing authentication for critical functions occurs when sensitive operations like user deletion lack proper access validation. This vulnerability allows unauthorized users to execute privileged actions within the application's controller or service layers.

Add role-based access control to a Spring Boot controller by applying @PreAuthorize annotations to critical endpoints. This ensures only authenticated users with specific roles can execute sensitive operations like user management functions.

Yes, this authentication remediation approach works directly with SAST findings. It targets vulnerabilities identified by Static Application Security Testing tools and automatically implements the necessary authentication checks and access controls.

Spring Security is required to remediate missing authentication vulnerabilities using this approach. The implementation relies on Spring Security annotations like @PreAuthorize and @AuthenticationPrincipal to enforce role-based access control.

Use @PreAuthorize to enforce role-based access control on critical endpoints, and use @AuthenticationPrincipal to validate the authenticated user's identity. Both annotations work together to secure sensitive Java controller operations.