OWASP API #2 — Broken Authentication: When APIs Forget to Verify Who You Are

Imagine you arrive at an airport. Instead of checking your passport, the security officer simply asks:

“What’s your name?”

You say, “John.”

The officer smiles and lets you board the flight.

Sounds ridiculous, right?

Unfortunately, many APIs make the same mistake.

Instead of properly verifying users, they trust requests too easily. This is exactly what Broken Authentication is all about.

What is Broken Authentication?

Broken Authentication happens when an API fails to properly verify the identity of a user before granting access.

Authentication answers one simple question:

“Are you really who you claim to be?”

If this process is weak or missing, attackers can impersonate users, access sensitive information, or even take over accounts.

Common Causes

Broken Authentication usually happens because of:

• APIs that don’t require authentication.
• Weak password policies.
• Missing Multi-Factor Authentication (MFA).
• No protection against brute-force attacks.
• Long-lived or predictable authentication tokens.
• Weak session management.

Real-World Case: Duolingo

In 2023, security researchers discovered an issue involving Duolingo’s API.

The API accepted an email address and returned information about the associated user account.

The problem?

The endpoint could be queried without proper authentication.

An attacker could automate requests using millions of email addresses and collect publicly available profile information at scale.

Although passwords were not exposed, the data could be used for phishing, spam campaigns, and user enumeration.

-> Even if the data seems harmless, exposing it without proper authentication can create security risks.

How Pentesters Should Test

• 🔍 Test unauthenticated access
• 🔑 Validate authentication tokens
• 🚀 Perform brute-force testing
• 👤 Check user enumeration
• 🔄 Test session handling
• 🌐 Test every API endpoint
• ⚡ Attempt authentication bypass
• 📖 Review API documentation

Best Practices

Organizations should:

• Require authentication for sensitive APIs.
• Implement Multi-Factor Authentication where appropriate.
• Enforce strong password policies.
• Apply rate limiting to prevent brute-force attacks.
• Use short-lived access tokens with secure refresh mechanisms.
• Continuously test authentication controls.

Authentication should never rely on the user interface alone.

The API itself must verify every request.

That’s it for Day 2!

Tomorrow, we’ll explore OWASP API #3 — Broken Object Property Level Authorization (BOPLA), where we’ll see how APIs accidentally expose more data than they should.

Until then, feel free to connect with me on LinkedIn:

www.linkedin.com/in/narmadha-natarajan07

Thank you for reading !