# API Authentication Session

API authentication and session testing, unauthenticated endpoint exposure, token...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-authentication-session -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-authentication-session -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-authentication-session -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-authentication-session -g -a gemini-cli -y`

## Description

API authentication and session testing, unauthenticated endpoint exposure, token lifecycle (logout revocation, refresh rotation, expiry), credential flows, password policy, account enumeration, and API key weaknesses (OWASP API2)

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Authentication & Session Testing (OWASP API2)

## Purpose
Test API authentication mechanisms for bypasses: endpoints reachable without valid credentials, tokens that outlive their lifecycle, credential flows that leak or over-trust, and session handling that enables account takeover.

JWT/OIDC-specific token forgery belongs to jwt-security-testing and oauth-oidc-security.

## Preconditions
- At least one valid account/session
- A mapped API surface (endpoints, roles, auth scheme) from reconnaissance
- Auth tokens/cookies for the account under test

## Attack Surface Signals
- Bearer tokens, API keys, session cookies, basic auth, signed custom headers
- Auth-adjacent flows: login, register, password reset, MFA verify, token refresh, logout
- Endpoints that "should" require auth: profile, settings, internal status
- Tokens appearing in URLs, logs, or client-side storage

## Methodology

### Step 1: Identify the Mechanism
```bash
# What does the API advertise without credentials?
curl -sk -i "https://TARGET/api/users/me" | head -20
# Login and catalog what is issued (JWT? opaque token? cookie? refresh token?)
curl -sk -X POST "https://TARGET/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"user@example.com","password":"PASS"}' | jq 'keys'
```

### Step 2: Unauthenticated Endpoint Sweep (candidate collection)
```bash
for p in users users/me admin/settings health metrics debug actuator \
  actuator/env status info version config .env internal/status; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET/api/$p")
  echo "$p -> $code"
done
```
Non-401/403 responses are CANDIDATES. A finding requires the unauthenticated response to contain data or actions that should require authentication, not a 200 on a public health endpoint.

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-authentication-session/SKILL.md