SimpleModule.Hosting/SimpleModuleHostExtensions.cs:97-98 registers AddAuthorization() without a FallbackPolicy. The source generator emits MapGroup(...).RequireAuthorization() for every module's endpoint group, but any per-endpoint .AllowAnonymous() overrides the group requirement (per ASP.NET Core's IAllowAnonymous short-circuit in AuthorizationMiddleware).
Concrete impact
In one consumer (an invoice manager built on the framework), the bootstrap commit had .AllowAnonymous() on 28 of 28 business endpoints — the framework's group-level hardening was completely defeated by a copy-pasted call. Anonymous callers could read all customers, all invoices, and trigger outbound SMTP via /api/invoices/{id}/send. A focused security audit was the only thing that caught it.
Fix
In SimpleModuleHostExtensions.cs, change:
.AddAuthorization(o =>o.FallbackPolicy=newAuthorizationPolicyBuilder().RequireAuthenticatedUser().Build())
After this, .AllowAnonymous() becomes the explicit exception (login, health, favicon) instead of a silent override. Existing apps that already mark every endpoint correctly are unaffected. Apps that left endpoints accidentally open get a clean 401 instead of a data leak.
This is the single highest-leverage hardening change available — it converts a class of "I forgot" bug into a class of "I had to type it" bug.
SimpleModule.Hosting/SimpleModuleHostExtensions.cs:97-98registersAddAuthorization()without aFallbackPolicy. The source generator emitsMapGroup(...).RequireAuthorization()for every module's endpoint group, but any per-endpoint.AllowAnonymous()overrides the group requirement (per ASP.NET Core'sIAllowAnonymousshort-circuit inAuthorizationMiddleware).Concrete impact
In one consumer (an invoice manager built on the framework), the bootstrap commit had
.AllowAnonymous()on 28 of 28 business endpoints — the framework's group-level hardening was completely defeated by a copy-pasted call. Anonymous callers could read all customers, all invoices, and trigger outbound SMTP via/api/invoices/{id}/send. A focused security audit was the only thing that caught it.Fix
In
SimpleModuleHostExtensions.cs, change:After this,
.AllowAnonymous()becomes the explicit exception (login, health, favicon) instead of a silent override. Existing apps that already mark every endpoint correctly are unaffected. Apps that left endpoints accidentally open get a clean 401 instead of a data leak.This is the single highest-leverage hardening change available — it converts a class of "I forgot" bug into a class of "I had to type it" bug.