SH108: Spring Security allows every request

Severity: high · Category: authentication · Applies to: spring

Why it matters

permitAll() on every request, or on /**, switches authentication and authorization off for the whole application.

How to fix

End the rule chain with anyRequest().authenticated() and permit only the specific public paths, such as the login page and static assets.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH108

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH108