{"id":18477,"date":"2024-03-12T12:25:36","date_gmt":"2024-03-12T12:25:36","guid":{"rendered":"https:\/\/staging2022.42crunch.com\/?p=18477"},"modified":"2024-03-12T15:37:43","modified_gmt":"2024-03-12T15:37:43","slug":"how-to-protect-your-apis-from-broken-authentication-and-unrestricted-resource-consumption","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/how-to-protect-your-apis-from-broken-authentication-and-unrestricted-resource-consumption\/","title":{"rendered":"How to Protect your APIs from Broken Authentication and Unrestricted Resource Consumption"},"content":{"rendered":"

In a follow-up to our recent <\/span>blogpost<\/span> which explored the OWASP API Authorization risks<\/a>, this week we share highlights of our <\/span>webinar<\/span> which featured Philippe De Ryck and Isabelle Mauny talking about the Authentication challenges encountered when protecting your APIs<\/a>.\u00a0<\/span><\/p>\n

They explored just how potentially dangerous the combination of the two OWASP API Top 10 categories of Broken Authentication and Unrestricted \"\"Resource Consumption can be when an API endpoint is compromised and no rate limiting is implemented. <\/span><\/p>\n

The Broken Authentication risk relates to poorly implemented API authentication which enables attackers access to or to assume other users\u2019 identities to attack endpoints. Unrestricted Resource Consumption relates to where the API is not protected against an excessive amount of calls or payload sizes. Philippe highlighted how dangerous it can be when broken authentication is combined with a brute force attack on the forgot password functionality to enable unrestricted resource consumption. He cited the example of the smart weighing scale app vulnerability where no rate limiting restrictions were applied to the forgot password functionality which would allow attackers to effectively brute-force the six-digit code reset feature using a tool such as Burp Suite.\u00a0<\/span><\/p>\n

In essence, this was a straightforward attack which could be compounded ten-fold with an account enumeration vulnerability where the endpoint discloses whether an account exists or not. Now an attacker could probe the API using lists of email addresses to determine which addresses had been registered, conduct an account takeover and easily access potentially vast amounts of sensitive personal data. Such an enumeration vulnerability amplifies the risk and it is not a trivial matter to perform rate limiting when endpoints are unauthenticated as part of the attack <\/span>e.g. when a user forgets their password, they are not authenticated.<\/span><\/p>\n

Scale API Endpoint Protection to Counter Brute Force Attacks<\/span><\/h3>\n

Isabelle then demonstrated how with the 42Crunch API security platform companies are able to scale the enforcement of rate-limiting policies across authorization and authentication API endpoints wherever they may reside. Rate limiting is enforced within the firewall, not the API itself. This policy is implemented in the IDE (VS Code example in the diagram \u00a0below) and deployed in the CI\/CD pipeline (Azure DevOps example in the diagram below) to scale.\u00a0<\/span><\/p>\n

\"\"<\/p>\n

42Crunch API security testing and protection architecture example with VS Code and Azure DevOps<\/em><\/p>\n

\"\"<\/p>\n

42Crunch enforces rate limiting on every single request hitting the API<\/span><\/i><\/p>\n

Avoid JWT Pitfalls – Only Accept What You Expect<\/span><\/h3>\n

Next up was the combination of Broken Authentication with Security Misconfiguration. Security misconfiguration not only exposes sensitive user data but also system details that can lead to full server compromise. JSON Web Tokens or JWTs are identified as being in widespread usage to implement custom security mechanisms, but that they also lie at the heart of numerous API security failures, in particular<\/span> features such as authentication and authorization.\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Philippe quoted the example of the Apache Pulsar bug which permitted account takeovers due to a JWT vulnerability, namely <\/span>the signature of the token was not validated if the algorithm of the presented token was set to “none\u201d. This is known as the <\/span>alg:none <\/b>problem and was well documented at the time<\/a>. <\/span>\u00a0<\/span><\/p>\n

The IETF best current practices\u2019 memo for JWT (<\/span>Request for Comments RFC: 8725<\/span><\/a>) recommends that companies should adopt an approach to using JWT and this includes favoring that the tokens are signed by a specified cryptographic algorithm.\u00a0<\/span><\/p>\n

\"\"
\nEnsure that you also specify the cryptographic algorithm to sign the token<\/span><\/i><\/p>\n

Isabelle then demonstrated how 42Crunch enables a proactive approach to enforcing API security policies that prevents the combination of Broken Authentication and Security Misconfiguration at design time and enforce these policies at runtime. By enabling development and security teams to adopt a positive security model approach, 42Crunch\u2019s platform specifies exactly what is expected and acceptable by the API at runtime and ensures that any requests outside of these parameters are automatically rejected. For example, it will ensure that a specific cryptographic algorithm should be used to sign the token and in accordance with any particular libraries that are being used to create the JWT in a specific programming language.<\/span><\/p>\n

More comprehensive details on JWT can be found in our <\/span>original blogpost on \u201c7 Ways to avoid JWT Security Pitfalls<\/span><\/a>.\u201d<\/span><\/p>\n

Full webinar recording here: <\/span>https:\/\/42crunch.com\/webinar-top-things-you-need-to-know-about-api-security\/<\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In a follow-up to our recent blogpost which explored the OWASP API Authorization risks, this week we share highlights of our webinar which featured Philippe De Ryck and Isabelle Mauny talking about the Authentication challenges encountered when protecting your APIs.\u00a0 They explored just how potentially dangerous the combination of the two OWASP API Top 10 […]<\/p>\n","protected":false},"author":6,"featured_media":18479,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"Authentication challenges encountered when protecting your APIs.\u00a0","_seopress_titles_desc":"Summary of webinar discussion between Philippe De Ryck and Isabelle Mauny on the Authentication challenges encountered when protecting your APIs.\u00a0","_seopress_robots_index":"","site-sidebar-layout":"default","site-content-layout":"disabled","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"disabled","ast-hfb-above-header-display":"disabled","ast-hfb-below-header-display":"disabled","ast-hfb-mobile-header-display":"disabled","site-post-title":"disabled","ast-breadcrumbs-content":"disabled","ast-featured-img":"disabled","footer-sml-layout":"disabled","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"footnotes":""},"categories":[6],"tags":[25,15,17],"_links":{"self":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/18477"}],"collection":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/comments?post=18477"}],"version-history":[{"count":2,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/18477\/revisions"}],"predecessor-version":[{"id":18501,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/18477\/revisions\/18501"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media\/18479"}],"wp:attachment":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media?parent=18477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/categories?post=18477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/tags?post=18477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}