SEC024
HTTP handler without authorization check
Object Pascal — Delphi & Free Pascal
Warning
Security
Handlers that process requests without auth checks expose functionality to unauthenticated users
handlers that process requests without auth checks expose functionality to unauthenticated users.
Why this severity
handlers that process requests without auth checks expose functionality to unauthenticated users.
Known false positives
public endpoints that are intentionally open (health checks, login pages).
Remediation example
procedure TWebModule.HandleAction(Request: TWebRequest); begin if not IsAuthorized(Request) then Exit; ProcessRequest(Request); end;