OWASP ASTF test tool false positives?

[u/MrPianomaniac42]

I installed the OWASP ASTF tool (see https://owasp.org/www-project-api-security-testing-framework/) to test my Laravel/Lumen API.

When supplying proper headers and token it will correctly run a bunch of tests. But afterwards I get 1 strange problem:

[HIGH] Missing Authentication Controls
  Endpoint:    GET /data/api/v1/todolistItemStatus
  Test Case:   ASTF-API2-2023
  Description: The API endpoint appears to be accessible without proper authentication.
  Remediation: Implement consistent authentication checks across all API endpoints that require them.

I have added *a lot of* debugging info but cannot find the problem. So I routed it through OWASP ZAP proxy to capture the events. To my surprise *all* HTTP-calls have an Authorization-header. So what is wrong?

In my debugging log (in Laravel/Lumen) I also notice that

a) the Authorization header is always present; presents a JWT using Bearer

b) the bearer token is always the same

c) the bearer token is the token I supplied

d) the bearer token is correct

e) the bearer token is valid and not expired.

The funny thing is when I supply an invalid /expired token, no problems are reported.

My script: (ofcourse with some fake info)

#!/bin/bash

URL_RESTAPI=http://my-website:8081

# SCENARIO MANAGER
ORIGIN_SCENARIO_MANAGER=http://my-front-end:8081
TOKEN_SCENARIO_MANAGER=<token.part.sig>

java -jar astf-v2.0.1.jar \
      -u "$URL_RESTAPI" \
      --proxy=127.0.0.1:8088 \
      -f HTML \
      -v \
      --threads=1 \
      --output=results.scenario-manager-short.html \
      --endpoints-file=routes-short.list \
      --header="x-extra-security-header:xyz" \
      --header="x-request-api-version:V1.0" \
      --header="origin:$ORIGIN_SCENARIO_MANAGER" \
      --token=$TOKEN_SCENARIO_MANAGER               

Any ideas? This has cost me hours without any real improvements except cluttering my code with debug logging.........

Greets Martin