SpringAuthTagger

A request attribute is set on the server side (an earlier filter marking the request authenticated), never by the caller: unset for a caller without a credential.

The same authorization annotations, as the bare names they are matched by when they decorate the controller class instead of a single handler.

A bean or filter registered only under a property or profile.

A field holding configuration: @Value-injected, or typed *Properties / *Config.

Keys that pull configuration from elsewhere (another file, a config server, Nacos) which can override the list.

A credential read with its receiver (request.getHeader("X-Api-Key")).

Spring Security switched on without a chain of the app's own: its default chain authenticates every request.

Reading what the caller presents as a credential. Without one, a filter that refuses with 403 checks something else (a Referer allowlist, an IP).

new FilterRegistrationBean<>(..) / Kotlin FilterRegistrationBean(..); not the type in a declaration (FilterRegistrationBean<X> reg().

What a preHandle that turns the caller away does: a 401/403 status or an auth exception. return false alone is not read: a rate limiter or maintenance switch returns false too.

The Kotlin DSL Spring Security documents for Kotlin apps: authorizeHttpRequests { authorize("/public/**", permitAll); authorize(anyRequest, authenticated) } (anyExchange in WebFlux).

request.requestURI in OPEN, OPEN.contains(uri) over a field of literals.

Lookups that see meta-annotations (@AnonymousGetMapping carrying @AnonymousAccess), against plain reflection that does not.

A credential local whose value for a missing credential is not plain: it tests for null or emptiness itself, or falls back with ?: / a ternary.

Filters that refuse for another reason than a missing credential. ponytail: a name list; a filter named for its credential check is not read further.

path.startsWith("/admin"), request.servletPath == "/login".

A method-security expression that admits an anonymous caller. Anything else, including a mixed permitAll() or hasRole(...), stays a guard.

A 401/403 status handed to a response helper (writeError(res, SC_UNAUTHORIZED)).

How much of a method's start is read for its opening refusal.

A refusal written as code: an unauthorized/forbidden factory or status, a 401/403 literal, an access-denied exception.

Reads of the current request that do not name the request parameter.

Security config URL rules. access { ... } is a protected rule too; permitAll() is intentionally tracked so a more-specific public matcher can suppress a broader protected one. The matcher's argument list is found by paren matching (it nests antMatcher(X) calls and spans lines), so only the call opener is a regex.

A chain's authorization DSL: a chain that has one yet yields no rule noir can read is a configuration it does not read. A SecurityConfigurer bean (http -> http.authorizeExchange(..)): a chain assembled from configurers, with no chain method of its own.

A servlet filter class header: Java extends OncePerRequestFilter / implements Filter, Kotlin : OncePerRequestFilter() / : Filter.

A statement that is one call (sendUnauthorized(res), throw ForbiddenException()), and its name.

An authorization noir does not read off access attributes.

An XML <http> element in the Spring Security namespace.

The per-endpoint shape: look at each endpoint, tag in place, hand the array back. Taggers declare only check_endpoint; those that need a pass over the whole set first (a project pre-scan, mcp's legacy prefixes) override perform and call super or loop themselves.