| name | api-auth-attacks |
| description | Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.
|
| domain | api |
| type | technique |
| stability | learning |
| modes | ["bugbounty"] |
| severity | high |
| owasp_api | ["API2:2023-Broken-Authentication"] |
| cwe | ["CWE-287","CWE-306"] |
| tools | ["burp","jwt_tool"] |
| schema_version | 1 |
API authentication attacks
When it applies
An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open
everything behind it.
Why it works
APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently:
some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and
error/timing differences enable enumeration and brute force.
Method
- No-auth endpoints: replay requests with the token removed; probe
/v1 vs /v2,
/internal, /debug, and undocumented routes (Swagger/OpenAPI) for missing auth.
- Token weaknesses: JWT issues (→
web-auth-jwt: alg confusion, weak secret, none); long/
non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked).
- Key leakage: hunt keys in JS bundles, mobile apps, git (→
code-review-secrets-detection),
and test their privilege/scope.
- Brute/enumeration: username enumeration via login/reset differences; weak rate limits on
login/OTP (→
web-race-conditions for OTP windows).
- Auth logic: password reset token predictability/leak, 2FA bypass, "remember me" tokens.
Gotchas
- Test every version and verb — the fix may exist only on the newest route.
- A leaked key must be live and privileged to matter — validate scope, don't over-collect.
- Rate-limit "bypass" via parallelism or header rotation is reportable on many programs.
Verify success
Authenticated access without valid credentials (no-auth route, forged/replayed token, or a live
leaked key performing a privileged action).
References
OWASP API Security Top 10 (API2); PortSwigger auth labs.
