Skip to content

ModuleAuthenticationInterceptor Fail-Closed Rollout

Scope

This document defines the separate follow-up pass to harden ModuleAuthenticationInterceptor so unmapped /rest/** and /Provider/** routes do not default to authenticated allow.

This is intentionally split from the immediate controller @PreAuthorize remediation because it has higher regression risk.

Current Risk

  • ModuleAuthenticationInterceptor.hasPermissionForUrl(...) currently returns true for unmapped REST and provider URLs when the user is authenticated.
  • Any missing SystemModuleUrl mapping behaves as fail-open, which can bypass module-based URL restrictions if method security is absent.

Rollout Strategy

Phase 1: Inventory and Impact Analysis

  1. Enumerate active request mappings under /rest/** and /Provider/**.
  2. Enumerate current SystemModuleUrl mappings in the target environment.
  3. Produce a diff:
  4. mapped endpoints
  5. unmapped endpoints currently relying on fallback allow
  6. Classify unmapped endpoints:
  7. intentionally public/open
  8. authenticated but role-gated by @PreAuthorize
  9. unaudited/high-risk

Phase 2: Controlled Fail-Closed Toggle

  1. Introduce a configuration flag for interceptor behavior:
  2. security.moduleUrl.failOpen (default true for compatibility)
  3. When disabled (false), unmapped REST/provider routes return deny unless explicitly allowlisted.
  4. Keep a narrow allowlist for known public routes already expected by SecurityConfig.

Phase 3: Staging Validation

  1. Enable fail-closed in staging only.
  2. Run focused smoke tests for:
  3. login/session flows
  4. known public endpoints
  5. Tier 1 admin endpoints now protected with @PreAuthorize
  6. analyzer bridge/runtime paths that were carve-outs in Phase 1
  7. Resolve missing SystemModuleUrl rows or explicit allowlist entries before production rollout.

Phase 4: Production Rollout

  1. Enable fail-closed with rollback switch kept available.
  2. Monitor authorization denials and endpoint error rates.
  3. Remove temporary allowlist entries once DB mappings and method security are complete.

Required Test Coverage

  • Unit tests for hasPermissionForUrl(...):
  • mapped allow
  • mapped deny
  • unmapped allow when failOpen=true
  • unmapped deny when failOpen=false
  • Integration-level smoke tests proving:
  • open endpoints remain reachable
  • authenticated users cannot reach unmapped protected routes
  • mapped admin routes remain accessible with correct roles

Exit Criteria

  • Fail-closed mode runs in staging and production without breaking known valid routes.
  • No Tier 1 admin endpoint depends on fallback allow behavior.
  • Remaining unmapped endpoints are either intentionally open (documented) or formally mapped.