Broken Authentication

How Broken Authentication Works

Broken authentication exploits fundamental flaws in how applications verify user identity and manage authenticated sessions. Unlike targeted attacks like brute force or credential stuffing, broken authentication describes systemic weaknesses in authentication architecture — the design decisions and implementation errors that make those targeted attacks possible. A single broken authentication flaw can undermine an entire application's security model, because authentication is the gateway to all authorized functionality.

Real-World Examples

Impact & Risk Assessment

Broken authentication is consistently ranked among the most critical web application vulnerabilities because it directly undermines the fundamental security boundary between authenticated and unauthenticated users. Successful exploitation grants attackers the same access as legitimate users — or administrators — without triggering authorization controls. Impact includes mass account takeover, unauthorized access to sensitive data, financial fraud, identity theft, regulatory violations (GDPR, HIPAA, PCI DSS), and reputational destruction. In enterprise environments, compromised authentication can provide the initial foothold for advanced persistent threats (APTs), enabling lateral movement, privilege escalation, and long-term data exfiltration. The 2023 Verizon Data Breach Investigations Report found that stolen credentials were involved in 49% of all data breaches.

How to Detect Broken Authentication

Monitor authentication systems for anomalous patterns: high rates of failed login attempts, successful logins from unusual geographic locations or IP addresses, simultaneous active sessions from different locations, logins outside normal business hours, and password reset requests for accounts without subsequent password changes. Implement session anomaly detection to identify stolen or forged tokens — sudden changes in user agent, IP address, or device fingerprint mid-session indicate session hijacking. Log all authentication events with contextual metadata (IP, user agent, device ID, geolocation) and implement real-time alerting on high-risk authentication patterns. Conduct regular audits of credential storage to ensure proper hashing algorithms and salt usage. Test password reset flows for information leakage and token predictability.

How to Prevent Broken Authentication

Implement multi-factor authentication (MFA) for all user accounts, especially administrative access — MFA mitigates the majority of credential-based attacks. Enforce strong password policies: minimum 12 characters, check against known breach lists (HaveIBeenPwned), and prevent common password patterns. Use bcrypt, scrypt, or Argon2id for password hashing with appropriate work factors. Implement proper session management: generate cryptographically random session tokens (minimum 128 bits of entropy), rotate tokens after authentication, set appropriate expiration times, and invalidate sessions on logout and password change. Set Secure, HttpOnly, and SameSite attributes on session cookies. Implement account lockout with exponential backoff after failed attempts. Use secure password reset flows with time-limited, single-use, cryptographically random tokens. Implement rate limiting on all authentication endpoints. Regular security testing should include authentication-specific test cases covering credential management, session handling, and authentication bypass scenarios.

Code Examples

import hashlib
import time

# VULNERABLE: Predictable session token generation
def create_session_vulnerable(user_id):
    # Token based on timestamp + user_id — predictable!
    token = hashlib.md5(f"{time.time()}{user_id}".encode()).hexdigest()
    return token

# VULNERABLE: Session doesn't expire, no rotation
sessions = {}

def login_vulnerable(username, password):
    user = db.query("SELECT * FROM users WHERE username = %s", (username,))
    # Weak: plain comparison, no hashing
    if user and user.password == password:
        token = create_session_vulnerable(user.id)
        sessions[token] = {'user_id': user.id}  # Never expires!
        return token
    return None

import secrets
import bcrypt
from datetime import datetime, timedelta

SESSION_TIMEOUT = timedelta(hours=1)
MAX_FAILED_ATTEMPTS = 5
LOCKOUT_DURATION = timedelta(minutes=15)

def hash_password(password):
    """Hash password with bcrypt (work factor 12)"""
    return bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

def verify_password(password, hashed):
    """Constant-time password verification"""
    return bcrypt.checkpw(password.encode(), hashed)

def create_session_secure(user_id):
    """Generate cryptographically random session token"""
    token = secrets.token_urlsafe(32)  # 256 bits of entropy
    session_store.set(token, {
        'user_id': user_id,
        'created_at': datetime.utcnow(),
        'last_activity': datetime.utcnow(),
        'ip': request.remote_addr,
        'user_agent': request.headers.get('User-Agent')
    }, ex=int(SESSION_TIMEOUT.total_seconds()))
    return token

def login_secure(username, password):
    """Secure login with rate limiting and session rotation"""
    # Check account lockout
    attempts = get_failed_attempts(username)
    if attempts >= MAX_FAILED_ATTEMPTS:
        lockout_until = get_lockout_time(username)
        if datetime.utcnow() < lockout_until:
            raise AuthError('Account temporarily locked')

    user = db.query("SELECT * FROM users WHERE username = %s", (username,))
    
    # Constant-time response whether user exists or not
    if not user or not verify_password(password, user.password_hash):
        increment_failed_attempts(username)
        # Generic message — don't reveal if username exists
        raise AuthError('Invalid username or password')

    # Reset failed attempts on success
    reset_failed_attempts(username)
    
    # Invalidate any existing sessions (prevent session fixation)
    invalidate_user_sessions(user.id)
    
    # Generate new session token
    token = create_session_secure(user.id)
    
    # Audit log
    log_auth_event('login_success', user.id, request.remote_addr)
    
    return token

const session = require('express-session');
const RedisStore = require('connect-redis').default;
const crypto = require('crypto');

app.use(session({
  store: new RedisStore({ client: redisClient }),
  
  // Cryptographically random secret
  secret: process.env.SESSION_SECRET,
  
  // Session configuration
  name: '__Host-sid',  // __Host- prefix enforces Secure + no Domain
  resave: false,
  saveUninitialized: false,
  
  cookie: {
    secure: true,      // HTTPS only
    httpOnly: true,     // No JavaScript access
    sameSite: 'lax',   // CSRF protection
    maxAge: 3600000,   // 1 hour expiration
    path: '/',
  },
  
  // Generate secure session IDs
  genid: () => crypto.randomBytes(32).toString('hex'),
  
  // Rolling expiration — extends on activity
  rolling: true,
}));

// Rotate session ID after authentication
app.post('/login', async (req, res) => {
  const user = await authenticate(req.body);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  // Regenerate session to prevent fixation
  req.session.regenerate((err) => {
    if (err) return res.status(500).json({ error: 'Session error' });
    req.session.userId = user.id;
    req.session.loginTime = Date.now();
    res.json({ success: true });
  });
});

// Proper logout — destroy session server-side
app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    res.clearCookie('__Host-sid');
    res.json({ success: true });
  });
});

Frequently Asked Questions

Related Attacks