Why Spring Security Misconfigurations Cause Critical Auth Bypasses and How To Test Them

// The security filter chain execution order:
// (Simplified — actual chain has ~15+ filters)

HTTP Request
    ↓
SecurityContextPersistenceFilter    // Loads/saves SecurityContext
    ↓
UsernamePasswordAuthenticationFilter // Handles form login (if configured)
    ↓
BasicAuthenticationFilter           // Handles HTTP Basic auth (if configured)
    ↓
BearerTokenAuthenticationFilter     // Handles JWT/OAuth2 (if configured)
    ↓
ExceptionTranslationFilter          // Handles security exceptions
    ↓
FilterSecurityInterceptor           // Enforces authorization rules ← KEY
    ↓
DispatcherServlet                   // Routes to controllers
    ↓
Controller method executes

// WAY 1: permitAll() — The request goes THROUGH security filters
// The authentication mechanism still runs
// If the user sends a token, it's still validated
// But access is permitted regardless of authentication result
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/public/**").permitAll()
);
// → Security filters run, authentication validated, access permitted
// → CORRECT for public endpoints

// WAY 2: web.ignoring() — The request BYPASSES ALL security filters
// No authentication processing occurs
// No CSRF protection
// No security context population
// The URL simply doesn't participate in security at all
webSecurity.ignoring().requestMatchers("/api/public/**");
// → Security filters DON'T run — request goes straight to controller
// → DANGEROUS for anything sensitive — authentication can't be enforced
// → Even if you add authentication checks to the controller,
//    the security infrastructure is completely absent

// VULNERABLE configuration — common in production Spring Boot applications

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // Configuration 1: The filter chain with rules
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/v1/**").authenticated()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));

        return http.build();
    }

    // Configuration 2: THE VULNERABILITY
    // This completely removes /api/v2/** from security processing
    // The rules in securityFilterChain() don't apply to /api/v2/
    // Including the .requestMatchers("/api/admin/**").hasRole("ADMIN") rule
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
            .requestMatchers(
                "/api/v2/**",           // ← EVERYTHING under /api/v2/ is PUBLIC
                "/actuator/health",     // Fine for health check
                "/swagger-ui/**",       // Fine for docs (in non-prod)
                "/v3/api-docs/**"       // Fine for OpenAPI spec
            );
    }
}

// SECURE: Use permitAll() instead of web.ignoring() for truly public endpoints
// NEVER use web.ignoring() for anything that might need authentication context

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Explicitly public — still goes through security filters
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers("/actuator/info").permitAll()

                // API versioning — apply SAME rules to all versions
                .requestMatchers("/api/v1/admin/**", "/api/v2/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/v1/**", "/api/v2/**").authenticated()

                // Catch-all
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));

        return http.build();
    }

    // Only use web.ignoring() for truly static resources that can NEVER
    // contain sensitive data and don't need authentication context
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
            .requestMatchers(
                "/static/**",      // CSS, JS, images
                "/favicon.ico"     // Browser default
                // NEVER: /api/**, /actuator/**, /admin/**
            );
    }
}

// VULNERABLE: Wildcard doesn't cover what the developer intended

http.authorizeHttpRequests(auth -> auth
    // Developer intends: protect all admin URLs
    // What this actually matches: /api/admin followed by EXACTLY ONE segment
    .requestMatchers("/api/admin/*").hasRole("ADMIN")

    // What it DOES protect:
    // /api/admin/users  ✓
    // /api/admin/settings  ✓

    // What it DOES NOT protect (bypasses):
    // /api/admin/users/export  ✗ (two segments after /admin/)
    // /api/admin/users/1/delete  ✗ (three segments)
    // /api/admin/  ✗ (trailing slash, zero segments)
);

// SECURE: Double wildcard covers all sub-paths
.requestMatchers("/api/admin/**").hasRole("ADMIN")

// What /** matches:
// /api/admin  ✓
// /api/admin/  ✓
// /api/admin/users  ✓
// /api/admin/users/export  ✓
// /api/admin/users/1/delete  ✓
// /api/admin/anything/nested/deeply  ✓

// VULNERABLE: Path normalization differences between Tomcat and Spring Security

// Spring Security checks: /api/admin/..;/users
// Tomcat normalizes to: /api/users
// Result: /api/users is requested but Spring Security evaluated /api/admin/..;/users
// If /api/admin/** is protected but /api/users is public → BYPASS

// Test variations:
bypass_variants = [
    "/api/admin/..;/users",           # Semicolon path traversal
    "/api/admin/%2F../users",         # URL-encoded slash traversal
    "/api/admin/./users",             # Current directory
    "/api/admin/%252F../users",       # Double-encoded slash
    "/api/users/../../admin/users",   # Up-directory traversal
    "//api/admin/users",              # Double leading slash
    "/api//admin/users",              # Double slash in path
]

# Spring Boot 3.x (Spring Security 6.x) addressed many of these
# Spring Boot 2.x applications are more susceptible
# Always test the specific Spring Boot version in scope

// Base controller — protected
@RestController
public class BaseAdminController {

    @GetMapping("/api/admin/users")
    @PreAuthorize("hasRole('ADMIN')")  // ← Protected
    public ResponseEntity<List<User>> getUsers() {
        return ResponseEntity.ok(userService.getAllUsers());
    }
}

// Subclass controller — VULNERABLE
// The @PreAuthorize annotation is NOT inherited by overrides
@RestController
public class ExtendedAdminController extends BaseAdminController {

    @Override
    @GetMapping("/api/v2/admin/users")  // Different mapping — new endpoint
    public ResponseEntity<List<User>> getUsers() {
        // @PreAuthorize from parent NOT applied here
        // This method is publicly accessible
        return ResponseEntity.ok(userService.getAllUsers());
    }
}

// SECURE: Annotate the override explicitly
@RestController
public class ExtendedAdminController extends BaseAdminController {

    @Override
    @GetMapping("/api/v2/admin/users")
    @PreAuthorize("hasRole('ADMIN')")  // ← Must be repeated on the override
    public ResponseEntity<List<User>> getUsers() {
        return ResponseEntity.ok(userService.getAllUsers());
    }
}

// VULNERABLE: Logic error in SpEL expression

@GetMapping("/api/reports/{id}")
@PreAuthorize(
    "hasRole('ADMIN') or " +
    "(hasRole('USER') and #reportId == authentication.principal.reportId)"
)
// Developer intends: Admin can see all reports, user can see their own
// The 'or' short-circuits: if user has ADMIN role, the whole expression is true
// BUT: the reportId comparison is between #reportId (Long) and
//      authentication.principal.reportId (String) → type mismatch → always false?
// No — Spring auto-converts. But what if reportId is null?
// null == null → TRUE → any user can access reports where reportId is null

public ResponseEntity<Report> getReport(@PathVariable Long reportId) {
    return ResponseEntity.ok(reportService.getReport(reportId));
}

// Testing the SpEL bypass:
GET /api/reports/null HTTP/1.1
GET /api/reports/0 HTTP/1.1
GET /api/reports/-1 HTTP/1.1
// Test edge cases in the expression

// What the analysis looks for:

// Pattern 1: Controller class with @PreAuthorize on class level
// but individual methods that override with weaker/no annotation
@RestController
@PreAuthorize("isAuthenticated()")  // Class-level: all methods need auth
public class UserController {

    @GetMapping("/api/users/{id}")
    // No annotation here — INHERITS from class level ✓
    public ResponseEntity<User> getUser(@PathVariable Long id) { ... }

    @GetMapping("/api/users/export")
    @PreAuthorize("permitAll()")  // ← Overrides class-level! Now public!
    public ResponseEntity<byte[]> exportUsers() { ... }
}

// Pattern 2: @Secured with role name vs hasRole() mismatch
@Secured("ADMIN")          // Uses the raw role name — requires "ADMIN"
@PreAuthorize("hasRole('ADMIN')")  // hasRole() adds "ROLE_" prefix — requires "ROLE_ADMIN"
// These are NOT equivalent if roles aren't stored with "ROLE_" prefix

// Pattern 3: @PreAuthorize on abstract method, concrete method unprotected
public abstract class BaseController {
    @PreAuthorize("hasRole('ADMIN')")
    public abstract ResponseEntity<?> sensitiveOperation();
}

public class ConcreteController extends BaseController {
    @Override
    // @PreAuthorize NOT inherited — this method is unprotected
    public ResponseEntity<?> sensitiveOperation() {
        return performAdminOperation();
    }
}

// VULNERABLE: Accepting multiple algorithms — confusion attack possible

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .decoder(jwtDecoder())
                )
            );
        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        // VULNERABLE: Accepts both RS256 and HS256
        // Attacker can use the public key as HMAC secret for HS256
        return NimbusJwtDecoder
            .withJwkSetUri("<https://auth.company.com/.well-known/jwks.json>")
            .jwsAlgorithms(algorithms -> {
                algorithms.add(MacAlgorithm.HS256);   // ← VULNERABLE
                algorithms.add(SignatureAlgorithm.RS256);
            })
            .build();
    }
}

// Also vulnerable: Not validating issuer or audience
@Bean
public JwtDecoder jwtDecoder() {
    NimbusJwtDecoder decoder = NimbusJwtDecoder
        .withJwkSetUri("<https://auth.company.com/.well-known/jwks.json>")
        .build();

    // MISSING: Issuer validation
    // MISSING: Audience validation
    // A token from ANY service using this JWKS endpoint is accepted

    return decoder;
}

// SECURE: Strict algorithm + claim validation

@Bean
public JwtDecoder jwtDecoder() {
    NimbusJwtDecoder decoder = NimbusJwtDecoder
        .withJwkSetUri("<https://auth.company.com/.well-known/jwks.json>")
        .jwsAlgorithm(SignatureAlgorithm.RS256)  // Single algorithm only
        .build();

    // Validate issuer and audience
    OAuth2TokenValidator<Jwt> issuerValidator =
        JwtValidators.createDefaultWithIssuer("<https://auth.company.com>");

    OAuth2TokenValidator<Jwt> audienceValidator = new JwtClaimValidator<>(
        JwtClaimNames.AUD,
        aud -> aud != null && aud.contains("<https://api.company.com>")
    );

    OAuth2TokenValidator<Jwt> combinedValidator = new DelegatingOAuth2TokenValidator<>(
        issuerValidator,
        audienceValidator
    );

    decoder.setJwtValidator(combinedValidator);

    return decoder;
}

// White box analysis: read JwtDecoder configuration

public class SpringSecurityJwtAnalyzer {

    public List<Finding> analyzeJwtConfiguration(ApplicationContext context) {
        List<Finding> findings = new ArrayList<>();

        // Get all JwtDecoder beans
        Map<String, JwtDecoder> decoders = context.getBeansOfType(JwtDecoder.class);

        for (Map.Entry<String, JwtDecoder> entry : decoders.entrySet()) {
            JwtDecoder decoder = entry.getValue();

            if (decoder instanceof NimbusJwtDecoder nimbusDecoder) {
                // Check algorithm allowlist
                Set<JWSAlgorithm> algorithms = extractAlgorithms(nimbusDecoder);

                if (algorithms.contains(JWSAlgorithm.NONE)) {
                    findings.add(new Finding(
                        "CRITICAL",
                        "JWT decoder accepts 'none' algorithm",
                        "Complete authentication bypass — forge any JWT"
                    ));
                }

                if (algorithms.size() > 1 &&
                    algorithms.stream().anyMatch(a -> a.getRequirement() == Requirement.REQUIRED)) {
                    findings.add(new Finding(
                        "HIGH",
                        "JWT decoder accepts multiple algorithms — confusion attack possible",
                        "Algorithm: " + algorithms
                    ));
                }

                // Check validator configuration
                OAuth2TokenValidator<Jwt> validator = extractValidator(nimbusDecoder);

                if (validator == null || validator instanceof JwtTimestampValidator) {
                    findings.add(new Finding(
                        "HIGH",
                        "JWT decoder missing issuer/audience validation",
                        "Tokens from any service with this JWKS will be accepted"
                    ));
                }
            }
        }

        return findings;
    }
}

// VULNERABLE: Reflecting origin with credentials

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            );
        return http.build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration config = new CorsConfiguration();

        // VULNERABLE: Reflects any origin sent in the request
        config.addAllowedOriginPattern("*");  // ← All origins allowed

        // CRITICAL: AllowCredentials=true with wildcard origin
        // This allows attacker-controlled sites to make
        // authenticated requests and read responses
        config.setAllowCredentials(true);      // ← Credentials allowed

        config.addAllowedMethod("*");
        config.addAllowedHeader("*");

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", config);
        return source;
    }
}

// SECURE: Explicit allowlist — no reflection, no wildcard with credentials

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration config = new CorsConfiguration();

    // Explicit allowlist — never allowedOriginPattern("*") with credentials
    config.setAllowedOrigins(Arrays.asList(
        "<https://app.company.com>",
        "<https://admin.company.com>"
    ));

    config.setAllowCredentials(true);  // Fine with explicit origins

    config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
    config.setAllowedHeaders(Arrays.asList(
        "Authorization",
        "Content-Type",
        "X-Requested-With"
    ));

    config.setMaxAge(3600L);

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", config);
    return source;
}

// SECURE actuator configuration:

@Configuration
public class ActuatorSecurityConfig {

    @Bean
    @Order(1)  // Higher priority than main security chain
    public SecurityFilterChain actuatorSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/actuator/**")
            .authorizeHttpRequests(auth -> auth
                // Only health and info public (for load balancer checks)
                .requestMatchers("/actuator/health", "/actuator/info").permitAll()
                // Everything else requires ACTUATOR_ADMIN role
                .anyRequest().hasRole("ACTUATOR_ADMIN")
            )
            // Use IP allowlisting for additional protection
            .httpBasic(Customizer.withDefaults());

        return http.build();
    }
}

// VULNERABLE: @PreAuthorize annotations have no effect
// because @EnableMethodSecurity is missing

@Configuration
@EnableWebSecurity
// @EnableMethodSecurity ← MISSING — without this, @PreAuthorize does nothing
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            );
        return http.build();
    }
}

// Controller — developer believes @PreAuthorize is enforced
@RestController
public class AdminController {

    @GetMapping("/api/admin/users")
    @PreAuthorize("hasRole('ADMIN')")  // ← Does NOTHING without @EnableMethodSecurity
    public ResponseEntity<List<User>> getAllUsers() {
        // Any authenticated user can reach this — @PreAuthorize is silently ignored
        return ResponseEntity.ok(userService.getAllUsers());
    }

    @DeleteMapping("/api/users/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id")
    // ← Also silently ignored — any authenticated user can delete any user
    public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
        userService.deleteUser(id);
        return ResponseEntity.noContent().build();
    }
}

// Detection in white box analysis:
// Look for @PreAuthorize usage without @EnableMethodSecurity in any @Configuration class

public class MethodSecurityAnalyzer {

    public Finding checkMethodSecurityEnabled(List<ClassInfo> configClasses,
                                               List<ClassInfo> allClasses) {
        // Check if method security is enabled
        boolean methodSecurityEnabled = configClasses.stream()
            .anyMatch(cls ->
                cls.hasAnnotation("EnableMethodSecurity") ||
                cls.hasAnnotation("EnableGlobalMethodSecurity")
            );

        if (!methodSecurityEnabled) {
            // Check if @PreAuthorize annotations exist in codebase
            long preAuthorizeCount = allClasses.stream()
                .flatMap(cls -> cls.getMethods().stream())
                .filter(method -> method.hasAnnotation("PreAuthorize") ||
                                  method.hasAnnotation("Secured") ||
                                  method.hasAnnotation("RolesAllowed"))
                .count();

            if (preAuthorizeCount > 0) {
                return new Finding(
                    "CRITICAL",
                    "Method security annotations present but @EnableMethodSecurity missing",
                    String.format(
                        "%d @PreAuthorize/@Secured annotations have NO EFFECT — " +
                        "any authenticated user bypasses all method-level authorization",
                        preAuthorizeCount
                    )
                );
            }
        }

        return null;
    }
}

// VULNERABLE: Incorrect @Order — less specific chain runs first

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // Chain 1: Public API — Order 2 (lower priority)
    @Bean
    @Order(2)
    public SecurityFilterChain publicChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/public/**")
            .authorizeHttpRequests(auth -> auth
                .anyRequest().permitAll()
            );
        return http.build();
    }

    // Chain 2: Admin API — Order 1 (should be higher priority)
    // BUT: the securityMatcher("/api/**") is more general than "/api/public/**"
    // When @Order(1) processes first, /api/public/users matches /api/**
    // and gets AUTHENTICATED requirement — blocking the public endpoint

    // WORSE: If Order(1) has permitAll() and matches /api/**:
    // Then /api/admin/users matches Chain 1 (order 1, /api/**)
    // and gets the permitAll() treatment — admin bypass

    @Bean
    @Order(1)
    public SecurityFilterChain adminChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")  // ← Too broad — matches /api/admin/ too
            .authorizeHttpRequests(auth -> auth
                .anyRequest().permitAll()  // ← If this matches admin URLs: bypass!
            );
        return http.build();
    }
}

// SECURE: Most specific matchers in lower-numbered (higher priority) chains

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // Chain 1: Admin — most specific, highest priority
    @Bean
    @Order(1)
    public SecurityFilterChain adminChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/admin/**")  // Specific admin namespace
            .authorizeHttpRequests(auth -> auth
                .anyRequest().hasRole("ADMIN")
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
        return http.build();
    }

    // Chain 2: Authenticated API
    @Bean
    @Order(2)
    public SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")  // General API — catches what admin chain doesn't
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
        return http.build();
    }
}