java-auth-config-audit

Java Authentication and Configuration Security Source Code Audit

In Java backend projects, authentication, authorization, and security configuration are the highest-frequency vulnerability output surfaces. This skill provides complete detection approaches for 6 major categories of white-box auditing, applicable to Spring Boot/Spring Security, Apache Shiro, and custom frameworks.

Related Skills

• java-framework-audit — Spring/Struts/MyBatis framework audit
• java-injection-audit — SQL/OGNL/EL injection audit
• java-serialization-audit — Deserialization vulnerability audit
• idor-methodology — Black-box IDOR testing methodology

In-depth Reference

• Detailed patterns for 6 categories of vulnerabilities (dangerous code/safe code/EVID evidence) -> references/auth-config-patterns.md

---

6 Categories of Risk Quick Reference Table

#	Category	Key Search Entry Points	Severity Level
1	Authentication Bypass	SecurityConfig, ShiroFilterFactory, doFilter	Critical
2	Privilege Escalation	DAO/Mapper query statements, @PreAuthorize, Controller parameters	High
3	JWT Security	Jwts.parser(), Algorithm.HMAC, SECRET_KEY	High
4	Encryption Configuration	MessageDigest, Cipher.getInstance, new Random()	High
5	Information Leakage	application.yml Actuator configuration, @ExceptionHandler	Medium
6	Business Logic	Balance/inventory operations, state machine transitions, payment callbacks	High

---

1. Authentication Bypass Audit Key Points

• Spring Security: Check FilterChainProxy matching rules,AntPathRequestMatcher and MvcRequestMatcher discrepancies (trailing slash/path suffix);requestMatchers order — permissive rules permitAll() placed first will override subsequent interceptors;permitAll() whether overly open (e.g., /api/**）
• Shiro: URI parsing discrepancies lead to bypass —/admin/ vs /admin vs /admin/..;/; CVE-2020-1957 / CVE-2020-11989 / CVE-2020-13933 and other path normalization series bypasses
• Custom Filter: doFilter() early return causes subsequent chain not to execute; whitelist regex not rigorous (e.g., startsWith("/public") can be matched by /publicevil )

2. Privilege Escalation Audit Key Points

• Horizontal Privilege Escalation: Interface only verifies login state but not resource ownership — DAO layer WHERE id = #{orderId} lacks AND user_id = #{currentUserId} condition
• Vertical Privilege Escalation: Controller/Service methods lack role annotation @PreAuthorize/@RequiresRoles; enumeration values (role IDs) can be guessed
• IDOR: Auto-increment IDs can be traversed; whether UUIDs are truly unpredictable; batch interfaces skip per-item permission checks

3. JWT Security Audit Key Points

• Algorithm Confusion: alg: none bypasses signature verification; RS256 -> HS256 attack (using public key as HMAC key)
• Hardcoded Key: In source code SECRET_KEY = "xxx" or application.yml plaintext configuration
• Missing Claims Validation: exp(expiration)/iss(issuer)/aud(audience) not verified, causing tokens to be reusable across environments
• Refresh Mechanism: refresh_token long-lived and not bound to user/device, can be refreshed indefinitely after theft

4. Encryption Configuration Audit Key Points

• Weak algorithms: MD5/SHA1 Using password hashing,DES/RC4 encryption,ECB modes (leaking data patterns)
• Correct approach: Use for passwords bcrypt/scrypt/argon2; use for symmetric encryption AES-GCM/AES-CBC+HMAC
• Hardcoded keys/salts: private static final String KEY = "..." or salts hardcoded in the code
• Insecure randomness: java.util.Random is predictable; security scenarios must use SecureRandom

5. Information disclosure audit points

• Actuator endpoint exposure: /env(environment variables/passwords),/heapdump(heap memory containing keys),/jolokia(remote code execution)
• Detailed error stack traces: Missing global exception handler; SQL errors/class names/paths returned directly to the client
• Debug mode: server.error.include-stacktrace=always、spring.devtools not removed
• Sensitive data logging: log.info("用户密码: {}", password) or full credit card numbers written to log files

6. Business logic audit points

• Concurrency race: Balance check and deduction are non-atomic operations (double-spending); coupon/points replay
• Parameter tampering: Amount/quantity/discount passed in by the client and not recalculated on the server; order amount can be negative
• Process bypass: Multi-step processes (register-verify-set password) lack state validation between steps, allowing direct jumps to subsequent interfaces

---

Detection checklist

Confirm item by item during the audit, and record EVID evidence for each item found:

• Spring Security configuration chain ordering issues or excessive permitAll
• Shiro filterChainDefinitionMap URI parsing discrepancy bypass
• Custom Filter/Interceptor early return or whitelist bypass
• Whether data queries are bound to the current user ID (horizontal privilege escalation)
• Whether sensitive interfaces have role/permission annotations (vertical privilege escalation)
• Whether JWT enforces the specified algorithm + secure key storage + full Claims validation
• Password storage bcrypt/scrypt/argon2; symmetric encryption AES-GCM and keys not hardcoded
• Random numbers use SecureRandom
• Actuator endpoints restrict access + authentication protection
• Global exception handler swallows stack traces; disable debug/devtools in production; no sensitive data in logs
• Atomicity of amount/inventory operations; multi-step process state machine validation