Scribd
Upload
5 views2 pages

Proper Authentication Practices

Improper authentication occurs when applications fail to verify user credentials securely, leading to potential security breaches. Key causes include insufficient authentication methods, reliance on client-supplied data, and lack of authentication controls for sensitive actions. Mitigation techniques involve avoiding client-side data trust, implementing secure password verification, strengthening JWT verification, and protecting critical functions with multi-factor authentication.

Uploaded by

Margretta Kalinovy
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as ODT, PDF, TXT or read online on Scribd
5 views2 pages

Proper Authentication Practices

Improper authentication occurs when applications fail to verify user credentials securely, leading to potential security breaches. Key causes include insufficient authentication methods, reliance on client-supplied data, and lack of authentication controls for sensitive actions. Mitigation techniques involve avoiding client-side data trust, implementing secure password verification, strengthening JWT verification, and protecting critical functions with multi-factor authentication.

Uploaded by

Margretta Kalinovy
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as ODT, PDF, TXT or read online on Scribd

Improper Authentication (Broken Authentication)

Definition:
Improper authentication occurs when an application fails to properly verify user credentials,
allowing attackers to bypass security controls, impersonate users, or access sensitive resources.
Causes:
1. Insufficient Authentication – Failing to verify credentials securely.
• Example: Comparing passwords in plain text instead of using secure hash
verification:
if([Link]().equals(inputPassword)) { /* BAD */ }
// Correct:
if([Link](inputPassword, [Link]())) { /*
SAFE */ }

• Weak JWT verification allowing token forgery:


[Link]().parseClaimsJws(token); // BAD if signature not verified

2. Incorrect Authentication – Relying on client-supplied data without server-side validation.


• Example: Trusting URL parameters, hidden fields, or user-agent headers for auth.
3. Missing Authentication Controls – Not protecting sensitive actions or resources.
• Example: Failing to require re-authentication for critical functions like changing
passwords or transferring funds.

Mitigation Techniques
1. Avoid trusting client-side data
• Do not use URL params, hidden fields, or client-side storage
(localStorage/sessionStorage) for authentication.
• Use secure, HttpOnly cookies for session tokens.
2. Verify account status
• Only allow active, non-locked, and non-expired accounts to authenticate.
3. Implement secure password verification
• Hash passwords using strong algorithms (e.g., BCrypt) and use constant-time
comparison to prevent timing attacks.
4. Strengthen JWT verification
• Use strong signing algorithms (HMAC, RSA, ECDSA).
• Securely manage secrets and set reasonable token expiration.
5. Protect critical functions
• Require multi-factor authentication (MFA) for high-risk actions.
• Enforce session timeouts, re-authentication, and proper session management to
prevent hijacking.

The broken authentication vulnerability in this lab focused on JSON Web Token security.
Make sure to:

•Sign tokens with a strong algorithm.


•Use a strong, unpredictable secret.
•Make sure the token expires by giving it a lifetime. The token lifespan depends on
the application's purposes, but it should not exceed 24 hours.

You might also like