Remediate OWASP A07:2025 Identification and authentication failures
Recipe ID
org.openrewrite.java.security.Owasp2025A07Artifact
org.openrewrite.recipe:rewrite-java-securityOWASP A07:2025 describes failures related to identification and authentication, including weak credential management, missing brute force protections, session fixation, hardcoded credentials, insecure "remember me", and missing multi-factor authentication. Same position as A07:2021 (no prior aggregator existed).
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.java.security.Owasp2025A07If the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.36.0Definition
This recipe runs the following recipes in order.
- Find secrets
org.openrewrite.java.security.secrets.FindSecrets - Find hardcoded authentication credentials
org.openrewrite.java.security.search.FindHardcodedAuthenticationCredentials - Find
User.withDefaultPasswordEncoder()usageorg.openrewrite.java.security.search.FindUserWithDefaultPasswordEncoder - Remove explicit configuration of SHA-256 as encoding and matching algorithm for
TokenBasedRememberMeServicesorg.openrewrite.java.spring.security6.UseSha256InRememberMe - Find weak Spring Security password encoders
org.openrewrite.java.security.search.FindWeakSpringPasswordEncoder - Find weak message digests used inside custom
PasswordEncoderimplementationsorg.openrewrite.java.security.search.FindWeakDigestInPasswordEncoder - Find unsigned JWT usage
org.openrewrite.java.security.search.FindUnsignedJwt - Find Spring Security configurations that disable session fixation protection
org.openrewrite.java.security.search.FindInsecureSessionFixationConfig - Find insecure Spring Security RememberMe configuration
org.openrewrite.java.security.search.FindInsecureRememberMeConfig - Find weak password encoder strength
org.openrewrite.java.security.search.FindWeakPasswordEncoderStrength - Find long or disabled HTTP session timeout
org.openrewrite.java.security.search.FindLongSessionTimeout - Insecure cookies
org.openrewrite.java.security.servlet.CookieSetSecure - Cookies missing HttpOnly flag
org.openrewrite.java.security.servlet.CookieSetHttpOnly
Data tables
Structured output this recipe can produce.
- Taint flowRecords taint flows from sources to sinks with their taint types.
org.openrewrite.analysis.java.taint.table.TaintFlowTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats