What API2:2023 Broken Authentication requires
OWASP API Security Top 10 (2023) API2:2023 Broken Authentication. Authentication endpoints and flows are assets that need to be protected. Additionally, "Forgot password / reset password" should be treated the same way as authentication mechanisms. An API is vulnerable if it: * Permits credential stuffing where the attacker uses brute force with a list of valid usernames and passwords. * Permits attackers to perform a brute force attack on the same user account, without presenting captcha/account lockout mechanism. * Permits weak passwords. * Sends sensitive authentication details, such as auth tokens and passwords in the URL. * Allows users to change their email address, current password, or do any other sensitive operations without asking for password confirmation. * Doesn't validate the authenticity of tokens. * Accepts unsigned/weakly signed JWT tokens (`{"alg":"none"}`) * Doesn't validate the JWT expiration date. * Uses plain text, non-encrypted, or weakly hashed passwords. * Uses weak encryption keys. On top of that, a microservice is vulnerable if: * Other microservices can access it without authentication * Uses weak or predictable tokens to enforce authentication This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.
Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated:
Primary source: https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/
SHA-256 integrity: 1f507bc76f028bc65f9d6e765641ae66cc5cc398537aeb0c055143a23c846280
Primary Citations — 12 traced to source
- OWASP API Security Top 10 (2023), API02:2023 Broken Authentication, How To Prevent: 'Make sure you know all the possible flows to authenticate to the API (mobile/ web/deep links that implement one-click authentication/etc.). Ask your engineers what flows you missed.'
- OWASP API Security Top 10 (2023), API02:2023 Broken Authentication, How To Prevent: 'Read about your authentication mechanisms. Make sure you understand what and how they are used. OAuth is not authentication, and neither are API keys.'
+ 10 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api02-broken-authentication.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api02-broken-authentication.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api02-broken-authentication
- Back to registry: Browse all 10,099 compliance nodes