Access Control: Missing Authentication¶

Identifier: missing_authentication

Scanner Support¶

Description¶

Resources or critical functions exposed without authentication may let unauthenticated attackers access protected functionality or data.

How we test: We compare authenticated and unauthenticated access to discovered resources and operations, then report cases where functionality expected to require an identity is reachable without valid credentials.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  missing_authentication:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.