From the course: Complete Guide to Application Security

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Broken authentication

Broken authentication

From the course: Complete Guide to Application Security

Start my 1-month free trial Buy for my team

Broken authentication

“

- [Instructor] Broken authentication is a close second to broken object level authorization. Authentication weaknesses are easy to exploit and easy to detect, but they're a bit less widespread than broken object level authorization. So, how is broken authentication different? Authorization controls check whether permissions are appropriate after someone logs in. But that initial step of actually logging in is, that's right, authentication. Authentication vulnerabilities for APIs are very similar to authentication vulnerabilities for traditional web apps. Take credential stuffing attacks, for example. If an attacker has a list of usernames and passwords that they grabbed from the dark web, creds that were part of a data breach, then they might try to authenticate to your API using those same credentials. They might try tens of thousands of credentials, but in the end, they only need one set of creds to work. And like it or not, end users do reuse passwords. And to make matters worse…

Contents