Authentication verifies the identity of a user, service, device, or other entity requesting API access. Authorization is separate: it checks whether that identity may use a particular resource or operation. section 7.1 section 2.3.2
Authentication is the first gate in API security. A typical flow verifies credentials and issues an access token; later requests present that token so the API can identify the caller. If attackers can take over accounts, steal tokens, forge tokens, or exploit weak validation, the rest of the security model can fail. section 4.4 section 7.0
Protect authentication flows by checking:
- Whether passwords and other credentials are managed securely, brute-force attempts are limited, and credential stuffing is addressed. section 4.4
- Whether multistep login flows avoid revealing which usernames or email addresses are registered. section 4.4
- Whether access tokens are correctly validated, including their integrity, expiration, and permitted use. section 4.4 section 7.8
- Whether every API, including an internal API, requires protection appropriate to the sensitivity of its data and operations. section 3.4
- Whether authentication is tested with missing, malformed, expired, or tampered credentials, rather than assumed to work. section 12.4
A minimal authentication test
A protected lesson endpoint should reject a request without credentials. A test can request GET /courses/{course_id}/lessons/{lesson_id} without an Authorization header and assert a 403 response. Related tests can send malformed, expired, or tampered access tokens. Authentication alone is not enough: separate tests should verify that an authenticated student cannot read another student's registration or reach an admin endpoint. section 12.1 section 12.4
Figure 7.1 During authentication, users exchange their credentials for an access token. During authorization, the API checks whether the access token is valid and the user has access to the requested resources.
Use the flow diagram to distinguish identity verification from authorization: credentials become an access token, then the API validates that token and its resource permissions. section 7.1
