API2:2023 — Broken Authentication

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real incidents mapped to the defenses that would have stopped them.

BREACH — Fortnite (2019) · 200M accounts · Token theft via OAuth redirect

Auth token stolen by exploiting a forgotten SSO page

An old OAuth redirect URL was still active and vulnerable to XSS. Clicking a crafted link silently sent the user's token to the attacker.

Stopped by: MIT 01 (secure OAuth implementation — validate all redirect URIs, audit all auth flows) + MIT 04 (short-lived tokens would limit the window of use) + MIT 07 (tokens in headers, not URLs, reduces redirect-based leakage)

BREACH — Spotify (2020) · Thousands of accounts · Credential stuffing

380M leaked credential pairs tested against Spotify's login API

No effective rate limiting on the login endpoint. Credentials from third-party breaches worked because users reused passwords.

Stopped by: MIT 02 (rate limiting per IP and per account) + MIT 03 (MFA — correct password still wouldn't be enough) + MIT 05 (secure hashing at the third-party sites would have made those passwords useless)

BREACH — Parler (2021) · 70TB scraped · No authentication

API endpoints returned user data with no auth token required

Missing authentication on content endpoints, combined with sequential IDs and no rate limiting, allowed full bulk scraping.

Stopped by: MIT 01 (require authentication on all endpoints — "public" content is not the same as "unauthenticated access") + MIT 02 (rate limiting would have massively slowed bulk downloads)

OWASP — Email Change Without Re-auth · Account takeover via stolen token

Stolen session token used to change email, trigger password reset

PUT /account accepted any valid token without password confirmation. One stolen token = permanent account takeover.

Stopped by: MIT 06 (re-auth required for email change) + MIT 04 (short-lived tokens reduce the theft window) + MIT 07 (tokens in headers, not URLs, reduces token theft vectors)

← Back Ready to test yourself? →