API2:2023 — Broken Authentication

✅

Module Complete

You finished API2 — Broken Authentication. Here's what you now understand:

✓What broken authentication is — the system that confirms identity can be bypassed, forged, or stolen

✓How it differs from API1 — API1 knew who you were but didn't check what you could access; API2 can't confirm who you are at all

✓Five attack patterns: credential stuffing, brute force without lockout, broken token validation (JWT alg:none), token leakage in URLs, and missing re-auth

✓Real incidents — Fortnite (200M accounts, OAuth redirect exploit), Spotify (380M credential pairs, no rate limiting), Parler (70TB scraped, no auth on endpoints)

✓Seven mitigations: proven standards, rate limiting + lockout, MFA, proper token validation, secure storage, re-auth for sensitive ops, tokens in headers not URLs

✓Why authentication is foundational — every other API security control assumes it worked correctly

The one thing to carry forward

Authentication isn't a gate you pass through once at login. It's a continuous contract: every request must prove identity, every token must be validated completely, every sensitive operation must re-verify the user. One gap in that contract is all an attacker needs.

← Back to Quiz Next: API3 — Broken Object Property Level Authorization →