5. Master the Basics, Break the Web: Authentication & Authorization Basics

Authentication & Authorization

1. Login → Session → Logout Flow

Authentication starts when a user submits valid credentials during login. If accepted, the server creates a session and issues a session token (usually via cookie) that identifies the user on every request. The session remains active until it expires or the user logs out, at which point the server invalidates the token.

Pentest Relevance:

• Testing whether sessions are properly created, renewed, and destroyed helps find Broken Authentication issues.
• Weak logout mechanisms or session reuse can allow attackers to hijack accounts.
• Pentesters check if old tokens still work and whether session fixation is possible.

💡Example: User logs in → server sets sessionID=abc123 → user navigates authenticated pages → logout should invalidate abc123. If the same token works after logout, the application is vulnerable.

2. Password reset workflow

A password reset process typically begins when a user submits their email to request a reset. The server then sends a time-limited, unique reset link or OTP to that email, allowing the user to set a new password. Once the new password is set, the token or code must become invalid to prevent reuse.

Pentest Relevance:

• Reset tokens must be strong, unpredictable, and tied to the correct user.
• Testing includes checking for token reuse, token leakage, user enumeration, and host header injection.
• Weak workflows can allow attackers to take over accounts without knowing the original password.

💡Example: Reset link: https://site.com/reset?token=XYZ123 If changing the email in the request or reusing the token works, it’s a major vulnerability.

3. Multi-factor authentication

Multi-Factor Authentication adds an extra verification step after entering a password. It typically uses something the user knows (password) plus something they have (OTP, authenticator app, SMS code) or are (biometrics). This additional layer makes it significantly harder for attackers to access accounts even if the password is compromised.

Pentest Relevance:

• MFA bypass tests include replaying OTPs, brute-forcing codes, abusing recovery flows, or exploiting session logic.
• Weak SMS-based MFA may be vulnerable to SIM swapping or interception.
• Misconfigured “remember me” tokens or fallback methods can expose bypass paths.

💡Example: User enters password → prompted for a 6-digit OTP → server validates the code before granting access. If the OTP can be reused or guessed due to weak rate limits, MFA becomes ineffective.

4. Roles & Permissions (RBAC)

RBAC (Role-Based Access Control) assigns permissions based on a user’s role instead of managing permissions individually. Common roles include user, admin, moderator, or support, each with different capabilities. The system checks a user’s role before allowing actions like viewing data, editing settings, or managing other users.

Pentest Relevance:

• Broken access control happens when the server fails to verify roles properly.
• Attackers may escalate privileges by modifying IDs, roles, or parameters.
• Pentesters test whether low-privileged users can access or perform admin-only actions.

💡Example: A normal user calling GET /admin/users should receive a 403 Forbidden. If the endpoint responds with data, the application has a serious authorization flaw.

5. JWT basics

A JWT (JSON Web Token) is a compact, URL-safe token used for stateless authentication. It contains user data encoded in JSON format and is signed using a secret or private key to prevent tampering. Because JWTs are self-contained, the server doesn’t need to store session data — authentication is validated by verifying the token’s signature.

JWT

Pentest Relevance:

• Weak signing keys or using alg: none can allow attackers to forge tokens.
• Sensitive data inside the JWT payload can leak user info since it’s only base64-encoded, not encrypted.
• Pentesters test token signature validation, expiration handling, algorithm usage, and improper trust by servers.

💡Example: A JWT token looks like: header.payload.signature If the signature is weak or not validated properly, attackers can modify the payload (e.g., change "role":"user" to "role":"admin").

6. API Keys & Tokens

API keys and tokens are used to authenticate and authorize applications or users when interacting with APIs. They act like digital passwords that grant access to specific services, endpoints, or resources. Depending on the implementation, these tokens may be long-lived (static keys) or short-lived (temporary access tokens).

Pentest Relevance:

• API keys stored in JavaScript, localStorage, or mobile apps can be extracted easily.
• Hard-coded or long-lived keys may grant broad access and lead to full service compromise.
• Pentesters test for key leakage, misuse, unrestricted scopes, and missing rotation mechanisms.

💡Example: A mobile app might include a key like: apiKey = "ABCD1234SECRET" If an attacker extracts it, they can directly call backend APIs without the app, often with full privileges.

Wrapping up here — next up: Input & Output Basics

Catch you soon 🙌,
Abinesh