Tech debt

This host carries no authorization construct of any kind across its eight operations, returns full server-side exception detail to every caller through a fault pipeline that is inferred* to be observational only, forwards job names and parameters downstream with no validation, and defaults to allowing any environment not explicitly listed in its allow/deny rules.

CRITICAL

Finding	Component	Impact	Recommended action
No authorization construct exists in this host's code — IIS is configured with both Windows Authentication and Anonymous Authentication enabled, and every operation's access requirement is "None in code"	UC4Service	Any caller who can reach the endpoint anonymously can invoke any of the eight job-execution operations, each of which can trigger arbitrary downstream job execution via UC4Client.ScheduleJob	Add explicit caller-identity authorization to at least the job-execution operations, or document and enforce the intended network-boundary protection that anonymous access currently relies on
includeExceptionDetailInFaults is enabled in Web.config (alongside customErrors mode="Off" and httpErrors errorMode="Detailed"), so every unhandled exception — including stack traces and internal type names — is returned to the caller	UC4Service, Web.config	Any caller of any of the eight operations can observe internal exception detail on any unhandled failure; the applied [LogErrorBehavior] service behavior is inferred* to log without shaping the fault — its origin package could not be resolved from packages.config, so this could not be independently verified (see Faults and error pipeline)	Set includeExceptionDetailInFaults="false" in the deployed configuration and introduce typed fault contracts so callers receive a controlled failure shape instead of raw exception detail

HIGH

Finding	Component	Impact	Recommended action
Job names and parameter values are forwarded to the downstream scheduling service without format, length, or content validation beyond a null check on jobName	UC4Service, Uc4Client	Unvalidated values reach the downstream UC4 scheduling service unchecked; the space-validation check that would catch malformed job/parameter names (BR-UC4-007) is declared in code but never called	Call UC4Service.Validate (or an equivalent check) before forwarding job name and parameter values downstream
An environment with no entry in the uc4.rules document is allowed by default, except environment 100, which is blocked by default	UC4Service	A new or forgotten environment is unprotected until an explicit rule is added to uc4.rules (see BR-UC4-002)	Change the default posture to deny-by-default for unmatched environments, requiring an explicit allow rule before jobs can run

Related documentation

• Index
• Overview
• Architecture
• Activation and hosting
• Operations
• Faults and error pipeline
• Authentication and authorization
• Dependencies
• Configuration
• Operations and processes
• Business rules
• Operational runbook

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

• src/WCF/SAIF.Services.WCF.UC4.Host/UC4Service.cs
• src/WCF/SAIF.Services.WCF.UC4.Host/Uc4Client.cs
• src/WCF/SAIF.Services.WCF.UC4.Host/Web.config
• src/WCF/SAIF.Services.WCF.UC4.Host/UC4JobRules.cs