API Authentication & Session Testing (OWASP API2)

Purpose

Test API authentication mechanisms for bypasses: endpoints reachable without valid credentials, tokens that outlive their lifecycle, credential flows that leak or over-trust, and session handling that enables account takeover.

JWT/OIDC-specific token forgery belongs to jwt-security-testing and oauth-oidc-security.

Preconditions

• At least one valid account/session
• A mapped API surface (endpoints, roles, auth scheme) from reconnaissance
• Auth tokens/cookies for the account under test

Attack Surface Signals

• Bearer tokens, API keys, session cookies, basic auth, signed custom headers
• Auth-adjacent flows: login, register, password reset, MFA verify, token refresh, logout
• Endpoints that "should" require auth: profile, settings, internal status
• Tokens appearing in URLs, logs, or client-side storage

Methodology

Step 1: Identify the Mechanism

# What does the API advertise without credentials?
curl -sk -i "https://TARGET/api/users/me" | head -20
# Login and catalog what is issued (JWT? opaque token? cookie? refresh token?)
curl -sk -X POST "https://TARGET/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"user@example.com","password":"PASS"}' | jq 'keys'

Step 2: Unauthenticated Endpoint Sweep (candidate collection)

for p in users users/me admin/settings health metrics debug actuator \
  actuator/env status info version config .env internal/status; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET/api/$p")
  echo "$p -> $code"
done

Non-401/403 responses are CANDIDATES. A finding requires the unauthenticated response to contain data or actions that should require authentication, not a 200 on a public health endpoint.