Language: Java
Label: safe
CWE: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Code:
    protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable();
      http.httpBasic();
      if (eurekaSecurityEnabled) {
        http.authorizeRequests()
            .antMatchers("/eureka/apps/**", "/eureka/instances/**", "/eureka/peerreplication/**")
            .hasRole(EUREKA_ROLE)
            .antMatchers("/**").permitAll();
      }
    }