Products

Pricing

Test Library

Solutions

Resources

See docs

Start free

Test Library

Broken Authentication by removing auth token

API doesn't validate the authenticity of token. Attacker can remove the auth token and access the endpoint.

Broken User Authentication (BUA)

"The endpoint appears to be vulnerable to broken authentication attack. The original request was replayed by removing victim's <b>auth</b> token. The server responded with 2XX success codes.<br>" "<b>Background:</b> Authentication is the process of attempting to verify the digital identity of the sender of a communication. Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism. While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed."

"The endpoint appears to be vulnerable to broken authentication attack. The original request was replayed by removing victim's <b>auth</b> token. The server responded with 2XX success codes.<br>" "<b>Background:</b> Authentication is the process of attempting to verify the digital identity of the sender of a communication. Testing the authentication schema means understanding how the authentication process works and using that information to circumvent the authentication mechanism. While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed."

Impact of the vulnerability

Impact of the vulnerability

Broken User authentication is a serious vulnerability. Attackers can gain control to other users’ accounts in the system, read their personal data, and perform sensitive actions on their behalf, like money transactions and sending personal messages.

Broken User authentication is a serious vulnerability. Attackers can gain control to other users’ accounts in the system, read their personal data, and perform sensitive actions on their behalf, like money transactions and sending personal messages.

How this template works

APIs Selection

The template includes a filter for the response code, specifically selecting APIs where the response code is greater than or equal to 200 and less than 300. This filter ensures that only APIs with successful responses are considered for further testing.

Execute request

The template specifies a single request to be executed. In this case, the request includes a step to remove the authentication header. This step simulates an attacker removing the authentication token to exploit the broken authentication vulnerability.

Validation

The template includes a validation step to check the response code of the executed request. Similar to the API selection filters, the validation ensures that the response code is within the range of 200 to 300, indicating a successful response. This confirms that the vulnerability was successfully exploited and the server responded with a 2XX success code.

Frequently asked questions

Q: What is the purpose of the "remove_auth_header" parameter in the test request

Q: How does the test determine if the authentication mechanism is broken

Q: What is the impact of the "Broken User Authentication" vulnerability

Q: What are the recommended references for understanding and addressing broken authentication vulnerabilities

Q: What is the severity level assigned to the "Broken User Authentication (BUA)" category

Q: What are the tags associated with this test

Loved by security teams!

Loved by security teams!

Product Hunt Badge

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Security team,

Loom

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Security team,

Loom

"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "

Security team,

Rippling

Explore other tests

JWT authentication bypass via jku header injection

CSRF Login attack

JWT Failed to verify Signature

JWT None Algorithm

CSRF test by removing csrf token

CSRF test by replacing with invalid csrf token

Learn more:

OWASP top 10

6 min read

What is Broken User Authentication (BUA)?

OWASP top 10

10 min read

What's changed in OWASP API Security Top 10 2023 Release Candidate from 2019?

Suggest API security tests

Suggest API security tests

We're actively building the test library. Suggest a test! If we like your suggestion, you will see it in the library in few days.

We're actively building the test library. Suggest a test! If we like your suggestion, you will see it in the library in few days.