The authoritative source for the definition, vulnerable patterns, example attack scenarios, and prevention guidance in this module. Attack scenarios on slides 14–15 are drawn directly from the OWASP API2 page. CWE references: CWE-204 (Observable Response Discrepancy), CWE-307 (Improper Restriction of Excessive Authentication Attempts). This course is an independent study companion — not affiliated with or endorsed by OWASP.

Check Point Research disclosed a multi-step vulnerability combining an XSS flaw on an abandoned Epic Games SSO subdomain with an insecure OAuth token redirect. An attacker could send a crafted link; when clicked, the victim's auth token was silently forwarded to the attacker without any login prompt. Over 200 million Fortnite accounts were potentially affected. Epic Games patched the issue approximately two months after disclosure. Referenced in slides 1, 5, 6, 26.

A database of approximately 380 million username/password pairs assembled from third-party breaches was used in a credential stuffing campaign targeting Spotify accounts. The Spotify login API had insufficient rate limiting for distributed attacks. Thousands of accounts were compromised. Spotify reset passwords for affected users and notified them via email. Referenced in slides 10, 26.

Before Amazon Web Services suspended Parler's hosting in January 2021, researchers discovered that Parler's API endpoints returned user content — posts, profiles, images, and videos — without requiring any authentication token. Combined with sequential integer post IDs and no rate limiting, this allowed automated bulk downloading of all content. Approximately 70 terabytes of data was archived before the platform went offline, including GPS metadata from videos. Referenced in slides 16, 26.

Authoritative reference on JWT structure, signing algorithms, and known vulnerabilities including the alg:none attack (discussed in slide 12), weak secret brute-forcing, and token expiry failures. Includes links to the JWT specification (RFC 7519).

Comprehensive implementation guidance on authentication flows, password storage (recommending Argon2id, bcrypt, scrypt), session management, MFA, and account lockout policies. Directly informs mitigations MIT 02 through MIT 07 in this module.

Background on why Argon2id is the current recommended password hashing algorithm, as referenced in MIT 05. Argon2id was the winner of the Password Hashing Competition and is memory-hard, making GPU-based cracking significantly more expensive than MD5 or SHA-based approaches.

Free interactive labs for practicing authentication vulnerabilities including brute force, credential stuffing simulation, JWT attacks, and OAuth misconfiguration. Excellent hands-on practice after completing this module.

The reference database for breach data that powers credential stuffing attacks. Useful for understanding the scale of leaked credential pairs that attackers use. Also provides a free API for checking whether user credentials appear in known breach datasets — useful for building "is your password known to attackers?" warnings.