Any authenticated user deletes accounts

Code reviewSecuritySenior–Staff~18 min

Review this Spring MVC admin endpoint.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 18 min

Mark a line and say what kind of problem it is.0 findings

1@RestController

2@RequestMapping("/admin")

3public class AdminController {

5 @PostMapping("/users/{id}/delete")

6 public ResponseEntity<Void> deleteUser(@PathVariable Long id,

7 @RequestHeader("Authorization") String auth) {

8 if (auth == null || auth.isEmpty()) {

9 return ResponseEntity.status(401).build();

10 }

11 userService.delete(id);

12 return ResponseEntity.ok().build();

13 }

14}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.