Description

Detects the use of insecure basic authentication in Java applications. Basic authentication sends credentials in plaintext encoded in base64, making them easily interceptable and exposing sensitive authentication data. This creates significant security risk as credentials can be captured through network sniffing.

Detection Strategy

• Scans Java source code for method calls to 'setBasicAuth'

• Identifies instances where basic authentication is configured through these method calls

• Reports a security issue when basic authentication is used, since it transmits credentials in an insecure format

• Evaluates the context of the authentication configuration to confirm it's not in a secure context

Vulnerable code example

import org.springframework.http.HttpHeaders;

public class VulnerableAuth {
    public void insecureBasicAuth() {
        // Vulnerable: Using setBasicAuth without credentials exposes empty authentication
        HttpHeaders headers = new HttpHeaders();
        headers.setBasicAuth();
        ...

✅ Secure code example

import org.springframework.http.HttpHeaders;
import org.springframework.util.StringUtils;

public class SecureAuth {
    public void secureBasicAuth(String username, String password) {
        // Safe: Validate credentials before setting basic auth
        if (!StringUtils.hasText(username) || !StringUtils.hasText(password)) {
            throw new IllegalArgumentException("Invalid credentials");...