Authentication and authorization¶
No authentication or authorization construct exists in PdfAPI's application code. This is an explicit finding, verified by an exhaustive scan across PdfAPI\, PdfAPI.Core\, and PdfApi.SyncFusionCore\, not a gap in analysis coverage.
Authentication¶
| Aspect | Finding |
|---|---|
| Mechanism | None found in code |
| Established by | Not applicable — no authentication construct is present in application code |
| Identity type | — |
| Configured in | PdfAPI\Web.config declares no <system.webServer><security><authentication> element |
| Anonymous access | Allowed — Pipelines\build-vars.yml provisions the IIS site with IISWindowsAuth: true and IISAnonymousAuth: true; with anonymous authentication enabled and no application-layer authorization, the endpoints are reachable without an authenticated caller* |
Authorization enforcement¶
| Mechanism | Scope | Declared in | Effect |
|---|---|---|---|
| None in code | — | — | Every routed request reaches the action; access relies entirely on network / IIS controls |
The following constructs were searched for across the whole solution closure and returned zero matches: [SaifAuthorize, [Authorize, [AllowAnonymous, ApiUser(, systemHashValue, IsInRole, IsAuthorized, HasAccess, CheckAccess, PrincipalContext, GroupPrincipal, DirectorySearcher, and any WCF SecurityService integration.
Access requirements by endpoint¶
| Endpoint | Requirement | Enforced by | On failure |
|---|---|---|---|
POST v1/convert |
None in code | — | Request proceeds |
POST v1/convert/{fileExtension} |
None in code | — | Request proceeds |
POST v1/extract |
None in code | — | Request proceeds |
POST v1/merge |
None in code | — | Request proceeds |
GET v1/legacy/download/{trackingId} |
None in code | — | Request proceeds |
GET v1/info/track/{trackingId} |
None in code | — | Request proceeds |
POST v1/info/pages/count |
None in code | — | Request proceeds |
POST v1/info/fields/exist |
None in code | — | Request proceeds |
POST v1/info/fields/flatten |
None in code | — | Request proceeds |
POST v1/info/validate |
None in code | — | Request proceeds |
POST v1/info/validate/pdfa |
None in code | — | Request proceeds |
POST v1/info/version |
None in code | — | Request proceeds |
GET buildVersion |
None in code | — | Request proceeds |
Secrets handling¶
| Secret | Retrieved by | Consumed by | Notes |
|---|---|---|---|
| Syncfusion license key | Hard-coded string literal (not retrieved via GetSecureConfigSetting) |
PdfApi.SyncFusionCore\LicenseHelper.cs |
Committed to source control — see Tech debt |
GetSecureConfigSetting is not called anywhere in this repository (Verified — zero matches across PdfAPI\, PdfAPI.Core\, PdfApi.SyncFusionCore\). No credential, encrypted setting, or crypto-hash-gated configuration is retrieved by this application.
Security rules¶
No authorization construct exists in code, so no SEC-API- rule is catalogued here. The absence itself is recorded in Authorization enforcement above and in Tech debt.
Related security-relevant findings (not authorization, but security-adjacent):
- Framework exception detail produced before the response envelope — config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always; applies in every environment, so an uncaught failure produces framework exception detail (including a stack trace) before ApiResponseHandler runs; the final client-visible envelope is unknown** (see Endpoints: Error response shape).
- Unbounded upload surface — maxRequestLength="1048576" (1 GB) and maxAllowedContentLength="1073741824" (1 GB) apply to endpoints that accept raw byte[] bodies with no authorization.
Related documentation¶
- API index
- Overview
- Architecture
- Endpoints
- Dependencies
- Configuration
- Operations and processes
- Business rules
- Data model
- Operational runbook
- Tech debt
Note: Statements marked with
*were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with**could not be confirmed; treat as unknown until verified.
Sources¶
- PdfAPI\Web.config
- PdfAPI\Controllers\v1\ConvertController.cs
- PdfAPI\Controllers\v1\ExtractController.cs
- PdfAPI\Controllers\v1\MergeController.cs
- PdfAPI\Controllers\v1\LegacyController.cs
- PdfAPI\Controllers\v1\InfoController.cs
- PdfAPI\Controllers\v1\ApiInfoController.cs
- PdfApi.SyncFusionCore\LicenseHelper.cs
- PdfAPI\App_Start\WebApiConfig.cs
- Pipelines\build-vars.yml