Documentation
  • 🍻Intro
    • Why API Security is Critical?
    • Pynt at a Glance
    • Who Should Use Pynt?
  • 👩‍💻API Security Testing
    • Security Testing Overview
    • Prerequisites for Running Pynt Scans
    • How to Install Pynt CLI
    • How to install Pynt Binary (Linux only)
    • Pynt CLI Modes
      • 🔵Pynt Command CLI Mode
      • 🔵Pynt Listen CLI Mode
    • Pynt Security Tests Coverage
      • Business Logic Tests
      • Injection Tests
      • Authentication Bypass Tests
      • Mass Assignment Tests
      • Server-Side Request Forgery Tests
      • Stack Trace In Response
      • Lack of Resources and Rate Limiting
      • File Path Manipulation
      • GraphQL Introspection Vulnerability
      • GraphQL Alias Overloading
      • LLM APIs Vulnerabilities
      • Insecure Transport Scheme
      • Basic Authentication
      • HTTP Desynchronization (Desync) Attack
    • Sensitive Data Exposure Detection
    • Pynt Scans Troubleshooting
      • Pynt CLI Troubleshooting
      • Pynt for Postman Troubleshooting
        • Troubleshoot Pynt Container not Running Error
        • Troubleshoot Empty API Key Error
        • Troubleshoot Unauthorized API Key Error
        • Troubleshoot Collection Not Found Error
        • Troubleshoot Non-Unique Collection Name Error
        • Troubleshoot Empty Collection Identifier Error
        • Troubleshoot Unreachable Target Error
        • Troubleshoot Target Responds with Errors Error
        • Troubleshoot Unresolved Target Domain Error
        • Troubleshoot Unresolved Variable Error
        • Troubleshoot TLS Handshake Fail Error
        • Troubleshoot Few Requests Error
        • Troubleshoot One User Only Error
        • Troubleshoot Failed Assertions Error
    • How To
      • How to Run Business Logic Tests with Pynt
      • How to associate a Pynt scan to an Application in Pynt Dashboard
      • How to tag a scan in Pynt
    • Benchmarks
      • Pynt vs OWASP crAPI
  • 🤲Security Testing Integrations
    • 🟠Pynt with API Testing Tools
      • 🔘Pynt for Postman
        • Fork Pynt Collection
        • Run Pynt Container
        • Run Pynt in Postman
        • View Scan Results in Postman
      • 🔘Pynt for Insomnia
      • 🔘Pynt for ReadyAPI
    • 🟠Pynt with API Testing CLIs
      • 🔘Pynt for Newman (Postman CLI)
      • 🔘Pynt for TestRunner (ReadyAPI CLI)
    • 🟠Pynt with Testing Frameworks
      • 🔘Pynt for .NET (xUnit)
      • 🔘Pynt for Selenium
      • 🔘Pynt for Rest Assured
      • 🔘Pynt for Jest
      • 🔘Pynt for pytest
      • 🔘Pynt for Go
      • 🔘Pynt for JMeter
    • 🟠Pynt on CI/CD
      • ❗How to get Pynt ID for CI/CD Authentication
      • 🔘Pynt for GitHub Actions
      • 🔘Pynt for Azure DevOps Pipelines
      • 🔘Pynt for GitLab
      • 🔘Pynt for Jenkins
    • 🟠Pynt with Burp Suite
    • 🟠Pynt with Browsers
      • 🔘Pynt for Firefox Browser
    • 🟠Live Traffic Connectors
      • 🔘eBPF
        • 🔘Key Components
      • 🔘Traffic Mirroring
    • 🟠Advanced Pynt Examples
      • 🔘Pynt as a Standalone Container
      • 🔘Pynt with Prerecorded Har Files
      • 🔘Pynt with cURL
  • 🈸Applications View
    • Application View Overview
    • Manage Applications
      • Add Application
      • Delete Application
      • Rename Application
    • Manage Sources for API Discovery
      • Add Source
      • Delete Source
      • View Source Info
      • Source Categories
        • API Documentation
          • Swagger
          • Postman Collection
        • API Gateways
          • AWS API Gateway
          • Azure API Gateway
          • Kong API Gateway
          • GCP API Gateway
          • Gravitee API Gateway
        • Testing (API Security Scans)
        • Live Traffic
          • Data Collection with eBPF
          • ALB Traffic Capture with AWS Traffic Mirroring
        • Code Repository
    • Application Dashboard
    • Generate Pentest Report
  • 📚API Catalog
    • API Catalog Overview
    • Navigate API Catalog
      • Filtering API Catalog by Application
      • API Catalog Customization
      • API Related Info
      • APIs at Risk
    • Manage API Source Gaps
      • New APIs
      • Untested APIs
      • Shadow APIs
      • Undocumented APIs
    • View Detailed Endpoint Info
  • ⏪Scan History
    • Scan History Overview
    • Navigate Scan History
      • Associating Scans with Specific Application
      • Filtering by Application
      • Scan Related Info
      • Scan History Customization
    • View Detailed Scan Info
    • Associate Vulnerabilities to Tickets with JIRA
  • Account Management
    • Single Sign-On (SSO)
      • Setting up Okta
      • Setting up Entra ID
Powered by GitBook
On this page
  • Introduction
  • What are the common mistakes made by developers?
  • How can I fix file path manipulation issues?
  • Test cases in this category
  1. API Security Testing
  2. Pynt Security Tests Coverage

Basic Authentication

Explore Pynt's documentation on Basic Authentication! Understand how Pynt safeguards against insecure authentication methods, ensuring robust security for your APIs.

At a Glance: Basic Authentication poses a security risks because it transmits credentials encoded in Base64, which is not encryption but merely encoding. Moreover, the credentials (username and password) are sent with every API request, increasing the risk of interception and exposure. Basic Authentication also lacks permissions granularity, making it difficult to enforce fine-grained access control. To prevent these issues, avoid using Basic Authentication and adopt more secure authentication methods like OAuth2 or token-based authentication to protect sensitive data and user accounts.


Introduction

Basic Authentication is an HTTP authentication method where user credentials (username and password) are concatenated with a colon, encoded in Base64, and included in the Authorization header of every HTTP request. This means that the credentials are repeatedly transmitted over the network, increasing the chances that they could be intercepted if the connection is not secure.

The primary concern with Basic Authentication is that Base64 encoding is not a secure way to transmit sensitive information. Base64 can be easily decoded, meaning that if the HTTP request is intercepted—especially over an insecure connection like HTTP—the credentials can be read by anyone monitoring the network traffic. This vulnerability can lead to unauthorized access, data breaches, and other security incidents.

Furthermore, Basic Authentication lacks permissions granularity. It does not support fine-grained access control, making it challenging to assign different permissions or roles to different users. This can result in users having more access than necessary, violating the principle of least privilege and increasing the potential impact of compromised credentials.

What are the common mistakes made by developers?

  1. Using Basic Authentication over Insecure Channels:

    • Sending credentials over HTTP instead of HTTPS, making them susceptible to interception.

  2. Assuming Base64 Encoding is Secure:

    • Believing that Base64 encoding provides security when it's merely an encoding scheme, not encryption.

  3. Transmitting Credentials with Every Request:

    • Including the username and password in every API call increases the risk of credential exposure.

  4. Lack of Permissions Granularity:

    • Failing to implement fine-grained access controls, leading to overly broad permissions for users.

  5. Storing Credentials Insecurely:

    • Saving encoded credentials in insecure locations like logs or configuration files without proper protection.

  6. Lack of Multi-Factor Authentication (MFA):

    • Relying solely on Basic Authentication without additional authentication factors increases risk.

  7. Not Rotating Credentials:

    • Failing to change passwords regularly, which can lead to prolonged exposure if credentials are compromised.

  8. Ignoring Account Lockout Policies:

    • Not implementing lockout mechanisms after multiple failed login attempts, making brute-force attacks easier.

  9. Insufficient Monitoring and Logging:

    • Not adequately monitoring authentication attempts, which can delay the detection of unauthorized access.

How can I fix file path manipulation issues?

Avoid Using Basic Authentication:

  • Adopt More Secure Methods:

    • Use authentication protocols like OAuth2, OpenID Connect, or JWT (JSON Web Tokens) that offer enhanced security features and support for permissions granularity.

Use HTTPS for All Communications:

  • Encrypt Data in Transit:

    • Ensure all API calls are made over HTTPS to encrypt the data between the client and server.

  • Enforce HTTPS:

    • Configure the server to redirect all HTTP requests to HTTPS and use HSTS (HTTP Strict Transport Security).

Test cases in this category

This test case queries excessive number of elements:

Test case
OWASP
CWE

[AB006] Basic Authentication

PreviousInsecure Transport SchemeNextHTTP Desynchronization (Desync) Attack

Last updated 6 months ago

👩‍💻
API8:2023
CWE-309