Authentication failures in APIs are typically caused by weak credential verification, token misuse, or session lifecycle gaps. Attackers exploit missing MFA, predictable tokens, weak password resets, and long-lived bearer tokens to impersonate users. APIs are especially exposed when mobile and SPA clients store tokens insecurely and when refresh token rotation is not enforced.
Use strong authentication controls: MFA for sensitive actions, secure password policy, and robust account recovery hardening. Implement short-lived access tokens, rotating refresh tokens, strict revocation on logout, and anomaly detection for suspicious login behavior. Validate token audience, issuer, expiry, and signature on every protected request.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#02api02-2019 Broken User Authentication
