Broken Authentication

Description

Broken Authentication occurs when an application fails to properly enforce or validate authentication requirements, allowing users to access protected functionality or resources without valid authentication. This may occur when authentication checks are missing, incorrectly implemented, inconsistently applied, or improperly validated. As a result, unauthorized individuals may gain access to sensitive information, protected pages, application features, or operations that should require a valid authenticated identity. The potential impact depends on the affected functionality, the sensitivity of the exposed information, and the level of access obtained.

Recommendation

Implement and consistently enforce secure authentication mechanisms across all application components, including web pages, API endpoints, and other protected resources. Verify authentication credentials and tokens on the server side, reject missing, invalid, expired, or otherwise unacceptable credentials, and ensure that protected functionality cannot be accessed by bypassing authentication checks. Do not rely solely on the presence of authentication headers, client-side controls, or other user-controlled values to establish an authenticated identity. Follow established security practices for session management, credential validation, and authentication enforcement.

References

• OWASP Authentication Cheat Sheet
• OWASP REST Security Cheat Sheet
• CWE-287
• CWE-306