Before getting into the specific penetration testing concepts, let's review how authentication is done in modern web applications.
Authentication schemes in web applications
Platform authentication
When using platform authentication, users send their credentials in every request's header, using the Authorization variable. Even when they have to submit their credentials only once, the browser or the system stores them and uses them when required.
There are several different types of platform authentication. The most common ones are discussed in the following subsections.
