OWASP #7: Identification and Authentication Failures

📋 What Is It?

Identification and Authentication Failures occur when applications don't properly verify user identity, implement weak authentication mechanisms, or fail to protect credentials and session tokens. This allows attackers to compromise passwords, keys, or sessions.

#7 OWASP Rank

132K Occurrences

22 CWE Mappings

⚠️ Common Exploits

Credential Stuffing: Using leaked credentials from other breaches
Brute Force: Automated password guessing attacks
Weak Passwords: Simple passwords like "password123"
Session Hijacking: Stealing or predicting session tokens
Missing MFA: No multi-factor authentication
Session Fixation: Forcing user into known session ID

🔴 Attack Flow

1. Attacker obtains leaked credentials list
↓
2. Targets site with no rate limiting
↓
3. Automated credential stuffing attack
↓
4. Finds valid username/password pairs
↓
5. BREACH: Multiple accounts compromised!

❌ Vulnerable Code

// Bad: Predictable session tokens
import random
session_counter = 1000

def create_session(user_id):
    # Sequential, easily guessable!
    session_id = f"SESSION_{session_counter}"
    session_counter += 1
    return session_id

// Bad: Weak password policy
def register_user(username, password):
    # No password strength requirements!
    if len(password) >= 4:  # Way too short
        save_user(username, password)

// Bad: No session timeout
session.permanent = True  # Session never expires!

// Bad: Session not invalidated on logout
def logout():
    return redirect('/login')  # Session still valid!
                

✅ Secure Code

// Good: Cryptographically random tokens
import secrets

def create_session(user_id):
    # 256 bits of entropy - unpredictable!
    session_id = secrets.token_urlsafe(32)
    session_data = {
        'token': session_id,
        'user_id': user_id,
        'created_at': datetime.now()
    }
    database.save_session(session_data)
    return session_id

// Good: Strong password policy
import re

def validate_password(password):
    if len(password) < 12:
        return False
    if not re.search(r'[A-Z]', password):
        return False
    if not re.search(r'[a-z]', password):
        return False
    if not re.search(r'[0-9]', password):
        return False
    return True

// Good: Proper session management
app.config['SESSION_COOKIE_SECURE'] = True  # HTTPS only
app.config['SESSION_COOKIE_HTTPONLY'] = True  # No JS access
app.config['PERMANENT_SESSION_LIFETIME'] = 1800  # 30 min timeout

def logout():
    session.clear()  # Invalidate session
    return redirect('/login')
                

✓ Prevention Checklist

Implement multi-factor authentication (MFA/2FA)
Enforce strong password policies (12+ chars, complexity)
Use cryptographically random session tokens
Implement rate limiting on login attempts
Account lockout after failed login attempts
Use secure session management (HttpOnly, Secure flags)
Implement session timeout (idle and absolute)
Invalidate sessions on logout
Check against compromised password databases
Use secure password storage (bcrypt/Argon2)

🔍 Detection & Tools

Testing Tools:

Burp Suite Hydra OWASP ZAP John the Ripper

Prevention Libraries:

Flask-Login Passport.js Django Auth Auth0

How to Test:

Test password policy with weak passwords
Attempt brute force attacks
Check if sessions are predictable
Verify session timeout and logout

🌍 Real-World Breaches

Dropbox (2012): Credential stuffing from LinkedIn breach compromised 68M accounts
Yahoo (2013-2014): 3 billion accounts compromised via weak authentication
Reddit (2018): SMS-based 2FA bypassed, highlighting need for stronger MFA
Marriott (2018): 500M guest records exposed via compromised credentials

📌 Quick Tips

DO NOT use predictable session tokens
DO NOT allow weak passwords
DO implement MFA/2FA
DO use rate limiting on auth endpoints
DO implement account lockout

📜 Compliance

Related Standards:

PCI-DSS Requirement 8.1-8.3
NIST 800-63B - Digital Identity
ISO 27001 A.9.2, A.9.4
CWE CWE-287, CWE-384

🔑 Identification & Authentication Failures