Fail-open authorization (Go pipeline)
A Go request pipeline performs authorization over request bodies that can exceed the size expected by the policy layer. Under the wrong error handling, the request can fail open. The task is to preserve authorization semantics while making oversized-body handling fail closed.
| Dimension | Preview |
|---|---|
| Ecosystem | Go |
| CWE class | CWE-636 (Not Failing Securely) |
| Security theme | Authorization under error conditions |
| Work type | Request-body handling at a security boundary |
| Disclosure | Class-level security brief |
| Grading focus | Fail-closed behavior and normal authorization flow |
Environment
The agent has to trace how request bodies move through authorization and where parser or limit errors become allow-or-deny decisions. The repair is small relative to the codebase, but only works if the agent understands the boundary between request handling and policy enforcement.
Evaluation focus
The environment separates true fail-closed handling from patches that only raise limits, consume the body too early, or preserve the error path while reporting the wrong authorization result. Strong solutions keep normal policy flow intact.