API2:2023 — Broken Authentication

Slide 13 · Token Leakage + Missing Re-auth

Two smaller mistakes. Both account-ending.

You don't need to crack the lock if someone left the key in the doormat.

Mistake 1: Tokens in URLs

When an auth token is passed as a URL query parameter, it leaks into:

• Server access logs — every request URL is logged. Token stays in logs for months or years.

• Browser history — saved locally, syncable across devices.

• Referrer headers — if the user clicks a link to another site, the full URL (including token) is sent as a Referer header.

• CDN and proxy caches — may cache the URL including the token in the query string.

# Wrong: token in URL GET /api/export?token=eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjo1fQ.abc123 # Right: token in header GET /api/export Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjo1fQ.abc123

Mistake 2: No Re-authentication for Sensitive Actions

If changing an email address only requires a valid session token — not the current password — then anyone who steals your token can take full control:

1. Steal token (via XSS, log leak, phishing)

2. PUT /account – change email to attacker@evil.com

3. Trigger password reset — reset link goes to attacker's email

4. Full account takeover. Original owner locked out.

← Back See these in real attack scenarios →