Web › Module 3 › Lesson 1
Broken Authentication
Spot weak login flows, credential stuffing, and missing account protections before attackers do
Visual · web_developer
Authentication proves who you are. Broken authentication means the app makes that proof too easy to forge, guess, or bypass.
Opening
The front door is only as strong as the lock
You can have HTTPS, firewalls, and fancy monitoring—but if login is weak, attackers walk right in. Broken authentication covers everything from predictable passwords and missing rate limits to “remember me” tokens that never expire. OWASP lists this as a top risk because almost every app has a login page, and developers often copy insecure patterns from old tutorials.
1. What “Broken Authentication” Means
Broken authentication is not one bug—it is a category of failures in how the app verifies identity. Common symptoms: • No lockout or rate limiting on failed logins • Weak or default credentials still accepted • Password reset links that never expire or leak in URLs • Session IDs that are short, predictable, or reused • Missing multi-factor authentication on sensitive accounts
2. Credential Stuffing vs Brute Force
Brute force
Try many passwords against one username—slow without rate limits.
Credential stuffing
Try username/password pairs stolen from other breaches—works when users reuse passwords.
Password spraying
Try a few common passwords against many accounts to stay under lockout thresholds.
3. Weak Patterns in Code
Anti-patterns that break auth (learn to recognize them)# No rate limit on login endpoint @app.post("/login") def login(user, password): if check_password(user, password): return create_session(user) return "Invalid credentials" # attacker can try forever # Password reset token in URL, no expiry reset_link = f"https://app.example/reset?token={token}&email={email}"
# No rate limit on login endpoint
@app.post("/login")
def login(user, password):
if check_password(user, password):
return create_session(user)
return "Invalid credentials" # attacker can try forever
# Password reset token in URL, no expiry
reset_link = f"https://app.example/reset?token={token}&email={email}"Defense baseline
Rate-limit logins, enforce MFA on admin accounts, use slow password hashes with unique salts, and monitor for impossible-travel or spike-in-failure alerts. Test only on apps you own or are authorized to assess.
Knowledge Check
Broken authentication primarily concerns:
Multiple choice
Knowledge Check
True or False: Credential stuffing reuses leaked username/password pairs from other sites.
True or False
Knowledge Check
A strong first fix for login abuse is often:
Multiple choice