API2:2023 — Broken Authentication

Slide 4 · Auth vs. Authorization

This is not the same as API1.

API1 knew who you were. API2 can't confirm who you are at all.

API1 — Broken Object Level Authorization

Authentication worked — the API knew who you were

The failure: it didn't check what you were allowed to access

You changed an ID in a request and got someone else's data

The question the API skipped: "Is this object yours?"

API2 — Broken Authentication

Authentication itself failed — the API can't confirm who you are

The failure: the identity check can be bypassed, tricked, or forged

An attacker becomes you — to the API, they look identical

The question the API skipped: "Are you really who you say you are?"

Why the order matters

Every other API security risk assumes authentication worked. Authorization, input validation, rate limiting — all of these assume you know who is making the request.

If authentication is broken, none of those other defenses matter. That's why it's #2.

← Back What happens when this breaks? →