auth-sec

# Authentication and Authorization Router This is the routing entry point for authentication, sessions, and authorization boundaries. Use it to decide whether the issue is mainly login mechanics, object-level authorization, browser trust boundaries, or identity protocols such as OAuth/JWT/SAML before going deeper. ## When to Use - The target includes login, registration, password reset, 2FA, sessions, JWT, OAuth, or SSO - You suspect object authorization flaws, cross-tenant access, cross-origin reads, CSRF, or protocol misconfiguration - You need to decide whether to test authentication or authorization first ## Skill Map - [Authentication Bypass](../hack-authbypass-authentication-flaws/SKILL.md): login bypass, password reset, 2FA, enumeration, brute-force protections - [IDOR Broken Object Authorization](../hack-idor-broken-object-authorization/SKILL.md): IDOR, BOLA, BFLA, missing object permissions - [JWT OAuth Token Attacks](../hack-jwt-oauth-token-attacks/SKILL.md): algorithm confusion, key trust issues, claim abuse, token forgery - [OAuth OIDC Misconfiguration](../hack-oauth-oidc-misconfiguration/SKILL.md): redirect URI, state, nonce, PKCE, account binding - [CSRF Cross Site Request Forgery](../hack-csrf-cross-site-request-forgery/SKILL.md): CSRF tokens, SameSite, JSON CSRF, login CSRF - [CORS Cross Origin Misconfiguration](../hack-cors-cross-origin-misconfiguration/SKILL.md): reflected Origin, credentialed cross-origin reads, allowlist bypass - [SAML SSO Assertion Attacks](../hack-saml-sso-assertion-attacks/SKILL.md): assertion wrapping, signature validation, audience, ACS boundaries ## Recommended Flow 1. First confirm the authentication model and session boundaries 2. Then confirm object-level and function-level authorization 3. Then move to token, cross-origin, and protocol details 4. If enterprise federation exists, continue with OAuth, OIDC, or SAML topics ## Related Categories - [api-sec](../hack-api-sec/SKILL.md) - Default credentials, username variants, wordlist sizing, and port focus are consolidated in [authbypass-authentication-flaws](../hack-authbypass-authentication-flaws/SKILL.md)