SonarQube API endpoints reachable without login on default configuration

Observed exposure

While reviewing a SonarQube deployment, I noticed that several REST endpoints—such as /api/system/status, /api/components/search, and /api/measures/tree—respond with JSON data without any credentials. My understanding is that this is the documented default behavior, since sonar.forceAuthentication (available since 6.7) ships disabled.

Decision to make

The instance is reachable from a broader network segment than intended, so anonymous users can read project metrics, quality gate status, and component listings. I want to restrict this, but the concern is the blast radius: CI pipelines, monitoring scripts, and third-party integrations currently call the API anonymously, and flipping the setting would return HTTP 401 to all of them until tokens are configured. There is also a reverse proxy terminating TLS in front of the server, and I am unsure whether that affects how authentication challenges behave for browser and API clients.

Questions

• Is there a supported way to limit anonymous access to only sensitive endpoints, or is sonar.forceAuthentication=true an all-or-nothing switch?
• What is the recommended migration path to enable forced authentication without breaking existing CI jobs—can user tokens be rolled out and validated before the flag is flipped?
• Are there known proxy header requirements so that enabling forced authentication does not cause redirect loops or UI access problems?