If your app is in the open internet, you wouldn't "trust the network" and let anyone send privileged requests without authentication.

Attackers could simply run a script to send requests to your API, no need for browser interaction, so you are probably already securing any privileged endpoints.

In that case **this attack / risk doesn't apply to you**.

import java.lang.annotation.Target;
import org.jspecify.annotations.NullMarked;

/**
 * Disables Animal Sniffer's checking of compatibility with older versions of Java/Android.
 *
 * <p>Each package's copy of this annotation needs to be listed in our {@code pom.xml}.
 */
@Target({METHOD, CONSTRUCTOR, TYPE, FIELD})
@NullMarked

  //  - Some providers may choose to also include alias names.
  //  - For example, the "SHA-1" algorithm might be referred to as "SHA1".
  //  - The algorithm name is not case-sensitive.
  @SuppressWarnings("deprecation") // We still need to test our deprecated APIs.
  private static final ImmutableMap<String, HashFunction> ALGORITHMS =
      new ImmutableMap.Builder<String, HashFunction>()
          .put("MD5", md5())

    private NameQueryResponse nameQueryResponse;

    @BeforeEach
    void setUp() {
        // Mock the OEM encoding configuration with lenient stubbing
        // since not all tests need this stub
        lenient().when(mockConfig.getOemEncoding()).thenReturn("UTF-8");

        // Initialize NameQueryResponse before each test
        nameQueryResponse = new NameQueryResponse(mockConfig);
    }

You don't necessarily need OAuth2 scopes, and you can handle authentication and authorization however you want.

But OAuth2 with scopes can be nicely integrated into your API (with OpenAPI) and your API docs.

Nevertheless, you still enforce those scopes, or any other security/authorization requirement, however you need, in your code.

In many cases, OAuth2 with scopes can be an overkill.

    assertThat(expected)
        .hasMessageThat()
        .isEqualTo("I bet you didn't think Thread.interrupt could throw");
    /*
     * We need to wait for the runner to exit. It used to be that the runner would get stuck in the
     * busy loop when interrupt threw.
     *
     * While we're at it, we confirm that the interrupt happened as expected.
     */

 *
 * @author Mike Bostock
 * @since 2.0
 */
@GwtCompatible
@J2ktIncompatible
public final class EnumBiMap<K extends Enum<K>, V extends Enum<V>> extends AbstractBiMap<K, V> {
  /*
   * J2CL's EnumMap does not need the Class instance, so we can use Object.class instead. (Or we
   * could use null, but that messes with our nullness checking, including under J2KT. We could

    assertThat(expected)
        .hasMessageThat()
        .isEqualTo("I bet you didn't think Thread.interrupt could throw");
    /*
     * We need to wait for the runner to exit. It used to be that the runner would get stuck in the
     * busy loop when interrupt threw.
     *
     * While we're at it, we confirm that the interrupt happened as expected.
     */

 *
 * @author Mike Bostock
 * @since 2.0
 */
@GwtCompatible
@J2ktIncompatible
public final class EnumBiMap<K extends Enum<K>, V extends Enum<V>> extends AbstractBiMap<K, V> {
  /*
   * J2CL's EnumMap does not need the Class instance, so we can use Object.class instead. (Or we
   * could use null, but that messes with our nullness checking, including under J2KT. We could

    /**
     * Gets the type of this pipe.
     *
     * @return the type of the pipe
     */
    int getPipeType();

    /**
     * Create a pipe handle
     *
     * @return pipe handle, needs to be closed when finished
     */
    SmbPipeHandle openPipe();