{
  "id": 17494077,
  "title": "HAPI FHIR endpoint discovery needs an authorization test",
  "url": "https://urgent.news/2026/10/31/hapi-fhir-endpoint-discovery-needs-an-authorization-test",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T23:43:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/hapi-fhir-endpoint-discovery-needs-an-authorization-test-21ik"
  },
  "original_language": "en",
  "account": "HAPI FHIR, an open-source implementation of the HL7 FHIR standard, faces security concerns regarding its endpoint discovery process. The API's authentication and authorization mechanisms determine whether a server reveals patient data, based on resource-level access policies. A simple search using the app title \"HAPI FHIR\" yielded different results: zero matches for a specific observation, but 2,300 matches when searching with the \"all\" sub_type, page 1, and a page size of 1. This discrepancy highlights the importance of testing endpoint authorization thoroughly.\n\nTo ensure proper security, analysts should use unauthenticated clients, clients with limited patient or resource scopes, and clients with administrative roles. They should also examine the server's response to known synthetic resources, resources outside the token's scope, and broad searches. It is crucial to record the HTTP status, returned resource types, bundle totals, and whether errors reveal resource existence.\n\nProduction environments must implement transport security, client/user authentication, and access control according to HL7's FHIR security guidance. Testing should be consistent and cover various scenarios, including self-hosted servers, servers using mutual TLS or reverse proxies, and servers with self-hosted test identity providers. It is essential to separate test data from clinical data and verify that the issuer, audience, signing key, token expiry, and client registration are correctly configured.\n\nUltimately, the primary concern is whether a specific endpoint enforces authentication and resource-level authorization. HAPI FHIR provides the API, but the deployment's security layer determines the actual access decisions.",
  "summary": "HAPI FHIR endpoint discovery needs an authorization test HAPI FHIR is a server implementation of the HL7 FHIR standard. Its REST API can expose patient, encounter, observation, medication, and other clinical resources. A title match on the product name can lead an analyst to a server, but the security decision depends on the API's authentication, authorization, and resource-level access policy.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}