Context-aware authorization verification for API endpoints using large language models

A system comprising:

• at least one hardware processor;
• and
• at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to perform operations including:
• receiving, from a source code repository or a build pipeline, source code including an implementation file and at least one service definition file,
• wherein the at least one service definition file includes metadata and a service interface definition;
• determining that the source code implements an Application Programming Interface (API) handler by:
• determining that the implementation file includes a reference to the service interface definition;
• determining, based on the metadata, that the API handler is associated with a public endpoint;
• determining, using a large language model, that the source code lacks an authorization check by:
• performing pattern recognition on the source code to determine absence of a direct call to an authorization function;
• and
• performing semantic analysis on the source code to determine absence of an indirect authorization check;
• and
• responsive to determining that the API handler is associated with a public endpoint and that the source code lacks an authorization check,
• transmitting, to a computer system, an alert indicating that the source code implements an API handler associated with a public endpoint and that the source code lacks an authorization check.

A method comprising:

• receiving, from a source code repository or a build pipeline, source code including an implementation file and at least one service definition file,
• wherein the at least one service definition file includes metadata and a service interface definition;
• determining that the source code implements an Application Programming Interface (API) handler by:
• determining that the implementation file includes a reference to the service interface definition;
• determining, based on the metadata, that the API handler is associated with a public endpoint;
• determining, using a large language model, that the source code lacks an authorization check by:
• performing pattern recognition on the source code to determine absence of a direct call to an authorization function;
• and
• performing semantic analysis on the source code to determine absence of an indirect authorization check;
• and
• responsive to determining that the API handler is associated with a public endpoint and that the source code lacks an authorization check,
• transmitting, to a computer system, an alert indicating that the source code implements an API handler associated with a public endpoint and that the source code lacks an authorization check.