[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571918-105":53,"doc-detail-571918-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","owasp-api-security-top-10-a2-broken-authentication-how-to-prevent","OWASP API Security Top 10 - A2 Broken Authentication - How to prevent","","Cheat sheet summarizing key OWASP API Security Top 10 risks with concrete scenarios and practical mitigation steps. Covers Broken Authentication, Broken Function Level Authorization, Injection, Excessive Data Exposure, Mass Assignment, and Improper Assets Management, including common exploit paths (weak auth, hidden admin endpoints, malicious input to interpreters, overbroad responses, unsafe parameter binding, use of staging or old versions). Provides prevention guidance such as stronger token handling, role-based authorization, strict input/output validation, schema-based controls, limiting access, and retiring vulnerable API versions.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/owasp-api-security-top-10-a2-broken-authentication-how-to-prevent/571918/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/owasp-api-security-top-10-a2-broken-authentication-how-to-prevent/571918.png","ImageObject",442,249,{"name":88,"@type":89},"Mary Man","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What causes Broken Authentication in APIs?","Question",{"text":109,"@type":110},"APIs implement authentication poorly, allowing attackers to impersonate users through weak credential handling, non-rotating or improperly secured API keys/tokens, missing access token validation, and exposure of credentials in URLs.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How do you prevent Injection risks in an API?",{"text":114,"@type":110},"Never trust API consumers, strictly define and enforce input schemas and types at runtime, validate/filter/sanitize all incoming data, and constrain API outputs to reduce the chance of data leaks.",{"name":116,"@type":107,"acceptedAnswer":117},"What is the recommended approach to mitigate Improper Assets Management?",{"text":118,"@type":110},"Inventory API hosts, restrict access to what must not be public, segregate production from non-production data, add external controls like API firewalls, retire old versions or backport fixes, and enforce strong authentication and secure policies such as redirects and CORS.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571918,1792015743,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":9,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":4},7421720224475,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","C H E A T S H E E T  \nOWASP  \nAPI Security Top 10  \n4 2 C R U N C H . C O M  \n\n| A2: BROKEN AUTHENTICATION |\n| --- |\n|  |\n| Poorly implemented API authentication allowing attackers to assume other users’ identities.\u003Cbr>USE CASES\u003Cbr>• Unprotected APIs that are considered “internal”\u003Cbr>• Weak authentication not following industry best practices\u003Cbr>• Weak, not rotating API keys\u003Cbr>• Weak, plain text, encrypted, poorly hashed, shared/default passwords\u003Cbr>• Susceptible to brute force attacks and credential stuffing\u003Cbr>• Credentials and keys in URL\u003Cbr>• Lack of access token validation (including JWT validation)\u003Cbr>• Unsigned, weakly signed, non-expiring JWTs\u003Cbr>HOW TO PREVENT\u003Cbr>• Check all possible ways to authenticate to all APIs\u003Cbr>• Password reset APIs and one-time links also allow users to get authenticated and should be protected just as seriously\u003Cbr>• Use standard authentication, token generation, password storage, MFA\u003Cbr>• Use short-lived access tokens\u003Cbr>• Authenticate your apps (so you know who is talking to you)\u003Cbr>• Use stricter rate-limiting for authentication, implement lockout policies and weak password checks |\n\n| A5: BROKEN FUNCTION LEVEL AUTHORIZATION |\n| --- |\n|  |\n| API relies on client to use user level or admin level APIs. Attacker figures out the “hidden” admin API methods and invokes them directly.\u003Cbr>USE CASES\u003Cbr>• Some administrative functions are exposed as APIs\u003Cbr>• Non-privileged users can access these functions if they know how\u003Cbr>• Can be a matter of knowing the URL, using a different verb or parameter\u003Cbr>/api/users/v1/user/myinfo /api/admins/v1/users/all\u003Cbr>HOW TO PREVENT\u003Cbr>• Don’t rely on app to enforce admin access\u003Cbr>• Deny all access by default\u003Cbr>• Grant access based on specific roles\u003Cbr>• Properly design and test authorization |\n\n| A8: INJECTION |\n| --- |\n|  |\n| Attacker constructs API calls that include SQL-, NoSQL-, LDAP-, OS\u003Cbr>and other commands that the API or backend behind it blindly executes.\u003Cbr>USE CASES\u003Cbr>Attackers send malicious input to be forwarded to an internal interpreter:\u003Cbr>• SQL\u003Cbr>• NoSQL\u003Cbr>• LDAP\u003Cbr>• OS commands\u003Cbr>• XML parsers\u003Cbr>• Object-Relational Mapping (ORM)\u003Cbr>HOW TO PREVENT\u003Cbr>• Never trust your API consumers, even if internal\u003Cbr>• Strictly define all input data: schemas, types, string patternsand enforce them at runtime\u003Cbr>• Validate, filter, sanitize all incoming data\u003Cbr>• Define, limit, and enforce API outputs to prevent data leaks |\n\n| A3: EXCESSIVE DATA EXPOSURE |\n| --- |\n|  |\n| API exposing a lot more data than the client legitimately needs, relying on the client to do the filtering. Attacker goes directly to the API and has it all.\u003Cbr>USE CASES\u003Cbr>• APIs return full data objects as they are stored by the database • Client application shows only the data that user needs to see\u003Cbr>• Attacker calls the API directly and gets sensitive data\u003Cbr>HOW TO PREVENT\u003Cbr>• Never rely on client to filter data\u003Cbr>• Review all responses and adapt responses to what the API consumers really need\u003Cbr>• Define schemas of all the API responses\u003Cbr>• Don’t forget about error responses\u003Cbr>• Identify all the sensitive or PII info and justify its use\u003Cbr>• Enforce response checks to prevent accidental data and exception leaks |\n\n| A6: MASS ASSIGNMENT |\n| --- |\n|  |\n| USE CASES\u003Cbr>• API working with the data structures\u003Cbr>• Received payload is blindly transformed into an object and stored\u003Cbr>NodeJS:\u003Cbr>var user = new User(req.body);\u003Cbr>[user.save](user.save) ();\u003Cbr>Rails:\u003Cbr>@[user = User.new](user = User.new) (params[:user])\u003Cbr>• Attackers can guess the fields by looking at the GET request data\u003Cbr>HOW TO PREVENT\u003Cbr>• Don’t automatically bind incoming data and internal objects\u003Cbr>• Explicitly define all the parameters and payloads you are expecting\u003Cbr>• For object schemas, use the readOnly set to true for all properties that can be retrieved via APIs but should never be modified\u003Cbr>• Precisely define at design time the schemas, types, patterns you will accept in requests and enforce th","cbCaiu4ge3qK2yXp","https://ap.wps.com/l/cbCaiu4ge3qK2yXp","pdf",2561862,"English","# A2: Broken Authentication\n# A5: Broken Function Level Authorization\n# A8: Injection\n# A3: Excessive Data Exposure\n# A6: Mass Assignment\n# A9: Improper Assets Management\n# A1: Broken Object Level Authorization","[{\"question\":\"What causes Broken Authentication in APIs?\",\"answer\":\"APIs implement authentication poorly, allowing attackers to impersonate users through weak credential handling, non-rotating or improperly secured API keys/tokens, missing access token validation, and exposure of credentials in URLs.\"},{\"question\":\"How do you prevent Injection risks in an API?\",\"answer\":\"Never trust API consumers, strictly define and enforce input schemas and types at runtime, validate/filter/sanitize all incoming data, and constrain API outputs to reduce the chance of data leaks.\"},{\"question\":\"What is the recommended approach to mitigate Improper Assets Management?\",\"answer\":\"Inventory API hosts, restrict access to what must not be public, segregate production from non-production data, add external controls like API firewalls, retire old versions or backport fixes, and enforce strong authentication and secure policies such as redirects and CORS.\"}]","OWASP API Security Top 10 - A2 Broken Authentication - How to prevent | PDF",1791924452]