title: Getting sonar critical issue with Spring security
body: <p>I'm using spring boot 2 with Okta Starter.My security config as below.</p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().anyRequest().authenticated().and().oauth2ResourceServer().jwt();
  
          // Send a 401 message to the browser (w/o this, you'll see a blank page)
          Okta.configureResourceServer401ResponseBody(http);
      }
  
  </code></pre>
  
  <p>All working fine as expected but sonar gives following security hotspot on  authorizeRequest() as below</p>
  
  <p>"Make sure that Permissions are controlled safely here</p>
  
  <p>Controlling permissions is security-sensitive. It has led in the past to the following vulnerabilities:</p>
  
  <p>CVE-2018-12999
  CVE-2018-10285
  CVE-2017-7455
  Attackers can only damage what they have access to. Thus limiting their access is a good way to prevent them from wreaking havoc, but it has to be done properly.</p>
  
  <p>This rule flags code that controls the access to resources and actions. The goal is to guide security code reviews.</p>
  
  <p>More specifically it will raise issues on the following Spring code:</p>
  
  <p>The definition of any class implementing interfaces
  org.springframework.security.access.AccessDecisionVoter</p>
  
  <p>org.springframework.security.access.AccessDecisionManager</p>
  
  <p>org.springframework.security.access.AfterInvocationProvider</p>
  
  <p>org.springframework.security.access.PermissionEvaluator</p>
  
  <p>org.springframework.security.access.expression.SecurityExpressionOperations</p>
  
  <p>org.springframework.security.access.expression.method.MethodSecurityExpressionHandler</p>
  
  <p>org.springframework.security.core.GrantedAuthority</p>
  
  <p>org.springframework.security.acls.model.PermissionGrantingStrategy</p>
  
  <p>The definition of any class extending class
  org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration</p>
  
  <p>Any method annotated with
  Pre-post annotations: @PreAuthorize, @PreFilter, @PostAuthorize or @PostFilter from org.springframework.security.access.prepost package.</p>
  
  <p>@org.springframework.security.access.annotation.Secured</p>
  
  <p>Calls to any of the following methods
  org.springframework.security.acls.model.MutableAclService: createAcl, deleteAcl, updateAcl</p>
  
  <p>org.springframework.security.config.annotation.web.builders.HttpSecurity: authorizeRequests</p>
  
  <p>The instantiation of an anonymous class implementing org.springframework.security.core.GrantedAuthority or of any class implementing this interface directly.
  It will also raise issue on JSR-250 annotations @RolesAllowed, @PermitAll and @DenyAll from javax.annotation.security package.</p>
  
  <p>Ask Yourself Whether
  at least one accessed action or resource is security-sensitive.
  there is no access control in place or it does not cover all sensitive actions and resources.
  users have permissions they don't need.
  the access control is based on a user input or on some other unsafe data.
  permissions are difficult to remove or take a long time to be updated.
  You are at risk if you answered yes to the first question and any of the following ones.</p>
  
  <p>Recommended Secure Coding Practices
  The first step is to restrict all sensitive actions to authenticated users.</p>
  
  <p>Each user should have the lowest privileges possible. The access control granularity should match the sensitivity of each resource or action. The more sensitive it is, the less people should have access to it.</p>
  
  <p>Do not base the access control on a user input or on a value which might have been tampered with. For example, the developer should not read a user's permissions from an HTTP cookie as it can be modified client-side.</p>
  
  <p>Check that the access to each action and resource is properly restricted.</p>
  
  <p>Enable administrators to swiftly remove permissions when necessary. This enables them to reduce the time an attacker can have access to your systems when a breach occurs.</p>
  
  <p>Log and monitor refused access requests as they can reveal an attack.</p>
  
  <p>See
  OWASP Top 10 2017 Category A5 - Boken Access Control
  SANS Top 25 - Porous Defenses"</p>
  
  <p>As a fix I did several things but still issue is there.</p>
  
  <p>Fix: </p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers("/api/**").access("hasAnyAuthority('CLIENT', 'ADMIN','OPERATION')").anyRequest()
                  .authenticated().and().oauth2ResourceServer().jwt();
  
          // Send a 401 message to the browser (w/o this, you'll see a blank page)
          Okta.configureResourceServer401ResponseBody(http);
      }
  </code></pre>
  
  <p>Can anyone helps on this?</p>