Broken authentication in modern API ecosystems usually combines weak identity proofing, insecure token handling, and insufficient session controls. Attackers exploit credential stuffing, replay attacks, token theft, and permissive auth flows to gain persistent access. This risk is amplified when machine-to-machine and user authentication models are mixed carelessly.
Require strong identity verification, harden login and recovery paths, and enforce robust token lifecycle controls. Use short token expiry, refresh token rotation, revocation lists, and device-aware anomaly detection. Scope tokens narrowly and validate cryptographic and claim integrity on every protected request.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#02api02-2023 Broken Authentication
