API › Module 2 › Lesson 2
Broken Authentication
Weak tokens, password endpoints, and session flaws in APIs
Opening
Login is only the start
Broken Authentication covers weak credential handling, long-lived tokens, missing MFA on sensitive APIs, and password-reset or refresh flows that anyone can abuse. One leaked token often equals full account access.
1. Common API auth failures
Credential stuffing
/login and /token with no rate limit or lockout.
Weak JWT / API keys
alg=none, shared HS256 secrets, keys in mobile apps, never-expiring tokens.
Broken recovery
Reset tokens in URLs, guessable OTPs, or email enumeration via status codes.
Refresh abuse
Refresh tokens that never rotate and work from any IP forever.
2. Hardening checklist
Short-lived access tokens, rotating refresh tokens, MFA for high-risk actions, rate limits on auth endpoints, constant-time password compares, and revoke lists for stolen tokens. Store secrets in a vault—not in client bundles.
Knowledge Check
A strong API token practice is:
Multiple choice