For the frameworks covered here, a new route is open until you add authentication. FastAPI and NestJS let you apply a dependency or guard to everything. Spring lets you finish a rule list with denyAll. Rails API mode removes cookie and session handling and leaves authentication to you. Make closed the default deliberately.
Why default matters to a scan
Scans find routes that answer without credentials. The usual cause is not a clever bypass but a route someone added last week without the protection the others have. A closed default shrinks that class of finding to the routes you chose to open.
How to close each framework
| Framework | Mechanism | Source |
|---|---|---|
| Spring Security | End the authorization rule list with anyRequest().denyAll() so unmatched requests are rejected | Spring Security reference |
| FastAPI | Pass dependencies to FastAPI(...) to cover every path operation, or to an APIRouter for a group | FastAPI tutorial |
| NestJS | Register a guard with APP_GUARD so it runs on all routes | NestJS guards docs |
| Rails API mode | Include an authentication approach in ApplicationController and apply it by default | Rails API guide lists authentication modules to add |
Spring's reference describes denyAll as turning the rule set "into an allow list". The Rails API guide notes that you add authentication yourself, listing basic, digest and token modules among those available.
Making the default visible
A closed default needs a visible, short exception list. Keep public routes together: a separate router in FastAPI, a public decorator in NestJS, an explicit permit block in Spring, a skipped before_action list in Rails. Reviewers can then see the open surface in one place instead of inferring it from the absence of a decorator.
Steps
- List the routes that must be public. Usually login, token, health and a few others.
- Apply the closed default in your framework from the table.
- Mark each public route explicitly.
- Run the test suite and fix failures that reveal routes relying on being open.
- Add a test that iterates routes and asserts anonymous requests get 401 or 403 except for the allowlist.
- Scan staging with and without credentials and compare.
What a closed default does not give you
Authentication says who you are. It does not say what you may touch. OWASP's first API risk is about checking, for each record a request names, that the logged in user may act on it. Add object level checks in handlers or services, and test with two users. Our FastAPI global dependency post, NestJS guard post and Spring rule order post go deeper per framework.
Try it yourself
Click through it at your own pace, or open it full screen. Look for findings about routes reachable without credentials.
Safeguard's policies and gates can enforce checks in your pipeline, and a free scan covers your dependencies.
Quick check
Is Spring Security closed by default?
Not automatically for your own rules. You choose the final rule, and the docs recommend denyAll for an allow list approach.
Does Rails API mode include authentication?
No. The guide lists authentication modules you can add, but you choose and apply them.
Sources
- Spring Security: authorize HTTP requests
- FastAPI: global dependencies
- NestJS guards
- Using Rails for API-only applications
- OWASP API1:2023
Last reviewed: 19 October 2026.
