Issue Details
Broken User Authentication
api02-2019 • Rank #2 in OWASP 2023
Explanation
Authentication failures in APIs are typically caused by weak credential verification, token misuse, or session lifecycle gaps. Attackers exploit missing MFA, predictable tokens, weak password resets, and long-lived bearer tokens to impersonate users. APIs are especially exposed when mobile and SPA clients store tokens insecurely and when refresh token rotation is not enforced.
Remedy
Use strong authentication controls: MFA for sensitive actions, secure password policy, and robust account recovery hardening. Implement short-lived access tokens, rotating refresh tokens, strict revocation on logout, and anomaly detection for suspicious login behavior. Validate token audience, issuer, expiry, and signature on every protected request.
| Year | Rank | Category |
|---|---|---|
| 2019 | #2 | api02-2019 - Broken User Authentication |