From the course: The OWASP API Security Top 10: An Overview

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

API2:2019 broken authentication

API2:2019 broken authentication

From the course: The OWASP API Security Top 10: An Overview

Start my 1-month free trial Buy for my team

API2:2019 broken authentication

“

- [Instructor] Next on the OWASP API security top 10 is broken authentication. OWASP describes this vulnerability as authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or exploit implementation flaws to temporarily or permanently assume other users' identities. Compromising the system's ability to identify the client or user compromises API security overall. So let's go ahead and break this down. When it comes to applications, authentication is a process of verifying the identity of a user. Broken authentication is what happens when authentication methods are implemented poorly. This can be when applications display sensitive authentication details like auth tokens and passwords in the URL. The application permits weak passwords and encryption keys or authentication tokens like JSON web tokens are misconfigured. These misconfigurations can lead to brute force…

Contents