Configure Authentication Validation

Authentication validation can discover API endpoints that do not perform an authentication check.

  1. In the main menu, click (Projects) and open a project that you want to configure.
  2. Click Features.
  3. In the Authentication Validation row, turn on the Enabled switch.
  4. To exempt some requests and responses from validation, you must set up exclusion rules. Do as follows:
    1. In the same row where you enabled Authentication Validation, click Configure exclusion rules.
    2. To create a new rule, click Add exclusion rule. Click Edit to change an existing rule.
    3. In the Create/edit exclusion rule page that opens, enter the following:
      Table 1. Fields for creating exclusion rules
      Option Description
      Request/response part From the dropdown list, choose how you want to identify the endpoints to be excluded from this checker:
      • Request path
      • Request parameter
      • Request header name
      Pattern Enter a pattern for matching paths, parameters, or headers of requests and responses you want to exclude. Endpoints that match this pattern will not be subject to the Authentication Validation checker.
      Note: You can use an asterisk (*) as a wild card in a pattern. For example: com.mycompany.testapp.*.

      Save your changes.

  5. Create a sanitizer with the type Auth, using the instructions in this page: Configure Sanitizers and Validators.
    Attention: A sanitizer is required for Authentication Validation to work properly.