authentication-failures

Authentication Failures — OWASP A07:2025

Rank: #7 (stable) | CWEs covered: 36 | Occurrences: 1.1 million+ New 2025 threat: Hybrid password attacks / password spray — attackers increment leaked credentials (e.g., Password1! → Password2!).

---

What This Skill Covers

Authentication Failures occur when an application's identity verification mechanisms are absent, weak, or bypassable. Key attack patterns:

• Credential stuffing / brute force — automated login attempts using leaked creds
• Weak/default passwords — accounts created with guessable or known-breached passwords
• Insecure credential recovery — password reset flows that leak information or are bypassable
• Missing or bypassed MFA — no second factor, or MFA that can be skipped
• Exposed session identifiers — tokens in URLs, logs, or referrer headers
• Session fixation — attacker sets a known session ID before authentication
• Improper session invalidation — sessions that survive logout or token revocation

---

Testing Checklist for FastAPI & Flask

Work through each section systematically. Mark ✓ pass, ✗ fail, N/A where not applicable.

1. JWT Implementation

# ✓ GOOD — short-lived tokens, claim validation
token = jwt.encode(
    {"sub": user_id, "exp": datetime.utcnow() + timedelta(minutes=15),
     "iss": "myapp", "aud": "myapp-client"},
    settings.SECRET_KEY, algorithm="HS256"
)
jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256"],
           audience="myapp-client", issuer="myapp")

# ✗ BAD — no expiry, no claim validation, accepts any algorithm
jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256", "RS256", "none"])

Checks:

• Access tokens expire in 15–30 minutes
• Refresh tokens rotate on use and are invalidated on logout
• aud (audience) and iss (issuer) claims are set AND verified on decode
• Algorithm is pinned to an explicit list — never include "none"
• JWT secret loaded from os.environ, minimum 32 characters
• Algorithm confusion attack prevented: RS256 keys never accepted as HS256 secrets