Authentication vulnerabilities
Authentication attacks are the most frequently encountered attack vectors in APIs, and fortunately, they are also one of the easiest to defend by following core best practices in handling JWT security, implementing OAuth2 securely, and hardening your passwords, tokens, and your reset process.
Handling JWTs securely
In Chapter 7, Token-Based Attacks, we looked at various attacks against JSON Web Tokens (JWTs), since JWTs are ubiquitous within modern API implementations. Fortunately, nearly all of these attacks can be eliminated entirely by the secure handling of JWTs in the code that generates and consumes them.
The first recommendation is to make sure you are using JWTs for their intended purpose (a portable way of exchanging information about identity and permissions) and not attempting to use them where they are ill suited, for example, as a session cookie. Using this anti-pattern means a user cannot be logged out until the JWT expires, and...
