Issue Details
Broken Authentication
api02-2023 • Rank #2 in OWASP 2023
Explanation
Broken authentication in modern API ecosystems usually combines weak identity proofing, insecure token handling, and insufficient session controls. Attackers exploit credential stuffing, replay attacks, token theft, and permissive auth flows to gain persistent access. This risk is amplified when machine-to-machine and user authentication models are mixed carelessly.
Remedy
Require strong identity verification, harden login and recovery paths, and enforce robust token lifecycle controls. Use short token expiry, refresh token rotation, revocation lists, and device-aware anomaly detection. Scope tokens narrowly and validate cryptographic and claim integrity on every protected request.
| Year | Rank | Category |
|---|---|---|
| 2023 | #2 | api02-2023 - Broken Authentication |