JAVA.INSEC.MAA : Missing Authentication Annotation (Java)

This checker identifies security issues related to authentication procedures, such as using no password for LDAP authentication or using the host name in conditions.

プロパティ

例

This code contains several methods, 11 annotated with Web API annotations (e.g., @GET) and 10 of them with authentication annotations (e.g., @RolesAllowed). Therefore, more than 80% (that is, more than the percentage indicated in parameter authenticatedWebAPIPercentage) of Web API methods are annotated with authentication information. So the following warning is produced by this checker:

public class WebAPIAuthentication {

    @RolesAllowed(value = { "admin" })
    class AuthenticatedWebAPI {   

    /* AuthenticatedWebAPI methods do not trigger "Missing Authentication Annotation (Java)"
     * warnings - even if not individually annotated - because the class itself is annotated.
     */ 
  
        @GET
        public String Get() {...}
        
        @PUT
        public String Put() {...}
        
        @POST
        public String Post() {...}
        
        @HEAD
        public String Head() {...}
        
        @DELETE
        public String Delete() {...}

        public String foo() {...}

        public String foo2() {...}

        public String foo3() {...}
    }

    @PermitAll
    @GET
    public String authenticatedGet() {...}

    @PermitAll
    @PUT
    public String authenticatedPut() {...}

    @DenyAll
    @DELETE
    public String authenticatedDelete() {...}

    @RolesAllowed(value = { "admin" })
    @HEAD
    public String authenticatedHead() {...}

    @PermitAll
    @POST
    public String authenticatedPost() {...}

    @GET
    public String unauthenticatedGet() {...} /* "Missing Authentication Annotation (Java)" 
                                              * warning issued here: more than 80% of methods with 
                                              * Web API annotations also have authentication  
                                              * annotations, but this method does not.
                                              */
    public String foo() {...}

    @PermitAll
    public String foo2() {...}

    public String foo3() {...}
}

解決法

Check if the warning actually corresponds to a real security issue related to authentication and, if that is the case, use a more secure authentication procedure.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。