API › Module 1 › Lesson 5
BeginnerModule 1Lesson 5/6
Authentication in APIs (OAuth, JWT)
OAuth 2.0 and JWT pitfalls that break API trust
15 min+56 XP1 quiz
Module progress5 of 6
Opening
Tokens are credentials
APIs often use OAuth access tokens or JWTs in Authorization: Bearer headers. Misconfigured redirects, weak JWT verification, or overbroad scopes equal account takeover.
1. OAuth quick threats
Redirect URI issues
Open redirect / loose redirect allowlists leak codes.
Implicit flow risks
Tokens in URLs/history are easier to steal.
State / CSRF
Missing state lets attackers bind victim auth to attacker session.
2. JWT pitfalls
Accepting alg=none, trusting unverified kid URLs, or confusing RS256/HS256 verification can forge admin tokens. Practice algorithm and signature flaws only in Cyberlium labs (lab_jwt_none_1).
Knowledge Check
1
alg=none JWT attacks succeed when servers:
Multiple choice