Authentication attacks

APIs are secured by controlling access based on a client’s identity (their authentication) and their permissions (their authorization). One of the most obvious and popular means to attack an API is to bypass the authentication controls by impersonating a client. Typically, this is done by guessing access credentials, stealing or forging credentials, or exploiting weaknesses in the authentication logic.

Insecure implementation logic

From an attacker’s perspective, there are two primary attack vectors: attacking a design weakness or exploiting an aspect of insecure implementation logic. Let us look at them in the following sections.

Credential attacks

For an API with a human user (where the authenticated user is a human or is delegated access to an authorized intermediary, such as an OAuth2 client), there will almost always be the need for credentials to be provided by the user. This is one of the most obvious points for an attacker to...