Summary

In this chapter, you learned that authentication is the process of confirming the identity of a user, while authorization involves determining the user’s level of access to a particular resource. You also learned about various authentication and authorization mechanisms. We dived into practical scenarios on breaking various authentication and authorization controls on the provided API. Finally, you saw a real case of an API authentication attack. While we gave a good list of mechanisms, they are not limited to the ones we provided. So, it is really important that you go out and look at different methodologies to find an authentication methodology that works for your API and learn the intricacies in them before implementing them.

In the next chapter, we will go elbows deep into API input validation to see how we can attack them, as well as understanding API encryption and decryption.