A-1340
🆓Error
Avoid pages without an authorization scheme.
Reason
Every page that requires authentication should also declare an authorization scheme. Authentication only proves who a user is; authorization decides what they are allowed to reach. Without an authorization scheme, any authenticated user can open the page, a common cause of broken access control. If this is intended, use the mustNotBePublicUser authorization scheme.
Set an authorization scheme on the page under Security → Authorization Scheme. Pages that are intentionally public (login, home) are exempt and are already excluded by the check.
Examples
Non-Compliant Example
page 1 (
name: Home
// ...
security {
// absence of authentication → defaults to private
// absence of authorizationScheme
}
// ...
) | Line | Column | Message |
|---|---|---|
| 4 | 5 | Page requires authentication but has no authorization scheme. |
Compliant Solution - ★★★★★
page 1 (
name: Home
// ...
security {
// absence of authentication → defaults to private
authorizationScheme: mustNotBePublicUser
}
// ...
) Compliant Solution - ★★★★★
page 1 (
name: Home
// ...
security {
authentication: public
}
// ...
) Page is actually designed to be public
Tests
Test SQL query
select aa.workspace || '.' || aa.alias || '.' || ap.page_id as identifier,
'Page ' || ap.page_id || ' of app ' || aa.alias || ' in ' || aa.workspace
|| ' requires authentication but has no authorization scheme.' as message
from apex_application_pages ap
join apex_applications aa
on ap.application_id = aa.application_id
and aa.workspace in aa.workspace
where ap.page_id != 0
and ap.page_id = round(ap.page_id) -- skip sub-pages / non-integer ids
and ap.page_requires_authentication = 'Yes'
and ap.authorization_scheme_id is null
and aa.workspace in (#ApexWorkspaces#)
Test results
| Identifier | Message | Migration |
|---|---|---|
| WORKSPACE.CUSTOMERS.1 | Page 1 of app CUSTOMERS in WORKSPACE requires authentication but has no authorization scheme. | - |
Parameters
Use parameters to customize the rule to your needs.
| Parameter | Description | Default Value |
|---|---|---|
| ApexWorkspaces | Comma-separated List of APEX workspaces owning APEX applications to check. | dblinter, dbl_gui |
References
- related to OWASP A01:2021 – Broken Access Control
- same as UC-1340