security: OpenAPI spec (/api/openapi.json) declares all 689 endpoints as unauthenticated due to missing securitySchemes #34996

Summary

The OpenAPI specification served at /api/openapi.json declares "security": [] globally with no securitySchemes defined in components. This documents all 689 endpoints as requiring no authentication, even though the server code enforces auth on the vast majority of them.

Steps to Reproduce

1. curl https://demo.dotcms.com/api/openapi.json | jq '.security, (.components.securitySchemes // "MISSING")'
2. Observe: global security is [], securitySchemes is absent
3. Run any automated security scanner (OWASP ZAP, 42Crunch) against the spec — all endpoints flagged as unauthenticated

Impact

• Attacker reconnaissance: The full 689-endpoint attack surface appears open — reducing enumeration effort to zero
• Developer misuse: Consumers of the spec may omit auth headers assuming endpoints are intentionally public
• Security audit failures: Automated scanners generate false positives on every endpoint, burying real issues
• Spec ≠ reality divergence: Erodes trust in API documentation as a security contract

Code Verification

All of the following resources properly enforce rejectWhenNoUser(true) in WebResource.InitBuilder — but the spec doesn't reflect this:

Root Cause

The openapi.json generator does not emit a securitySchemes block and JAX-RS resource methods lack @SecurityRequirement annotations.

Proposed Fix

1. Add securitySchemes to components:

"securitySchemes": {
  "Bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" },
  "BasicAuth": { "type": "http", "scheme": "basic" }
}

2. Set a global default requiring auth:

"security": [{ "Bearer": [] }]

3. Override with "security": [] at the operation level only for genuinely public endpoints (health checks, SAML metadata, login).

4. Annotate JAX-RS resource methods with @SecurityRequirement so the spec stays accurate as new endpoints are added.

Acceptance Criteria

• securitySchemes block present in components with Bearer JWT and BasicAuth schemes
• Global security defaults to [{ "Bearer": [] }]
• Genuinely public endpoints (health, auth, SAML metadata) explicitly declare security: []
• Automated security scanner against the spec produces zero false-positive "unauthenticated endpoint" findings for admin/protected resources
• @SecurityRequirement annotations added to all JAX-RS resource classes