thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Broken Authentication (API)

API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.

Definition

Examples include missing rate limits on login or token endpoints, accepting unsigned or weakly signed JWTs, not validating token expiration or audience, weak API keys in URLs and credential stuffing exposure. Mitigations include standard protocols (OAuth 2.0, OIDC), strict token validation, MFA, rate limiting and short-lived tokens.

Example

An API accepts JWTs with alg set to none, so forged tokens are trusted.

Exam tip

Use standards and validate every token claim; never invent custom auth for APIs.

Related terms