API Authentication & Authorization Security Checks Quiz Quiz

Enhance your expertise in API security by assessing your understanding of authentication and authorization checks within API testing. This quiz covers essential principles, common pitfalls, and security best practices in the context of API security testing and vulnerability prevention.

1. JWT Token Verification

   When testing an API that uses JWTs for authentication, what is the most important step to confirm the token’s authenticity?

   1. Validating the token’s digital signature
   2. Checking the token expiration claim only
   3. Decoding the token to read its header only
   4. Ensuring the token contains a user ID field

   Explanation: Validating the token’s digital signature is crucial because it ensures the token was issued by a trusted provider and has not been altered. Simply checking the expiration claim or ensuring a user ID field exists does not confirm the token’s integrity. Decoding the header alone only reveals metadata, not authenticity. Focusing on the signature helps prevent attacks involving forged or tampered tokens.

2. Broken Object Level Authorization

   You are testing an API endpoint that returns customer profiles based on an ID parameter. What security check helps prevent broken object level authorization vulnerabilities?

   1. Verifying that users can only access resources they are authorized to view
   2. Ensuring all database queries use SELECT DISTINCT
   3. Confirming the endpoint URL uses HTTPS
   4. Requiring the ID parameter to be a string instead of an integer

   Explanation: Verifying proper authorization ensures users cannot access data belonging to others, which is the core of preventing broken object level authorization. Using SELECT DISTINCT addresses data duplication but not security. HTTPS is important for transport security, yet it does not handle authorization logic. Restricting parameter types does not stop unauthorized data access.

3. Role-Based Access Control (RBAC) Checks

   Which test should you perform to verify that an API endpoint correctly implements role-based access control (RBAC)?

   1. Attempt to perform privileged actions using a regular user account
   2. Check the response time for each role
   3. Review the API documentation for a list of roles
   4. Inspect the HTML of the frontend application

   Explanation: Attempting privileged actions with a non-privileged account directly tests if RBAC is enforced by the API. Checking response time does not indicate authorization correctness. Reading documentation informs you about roles but not enforcement. Inspecting frontend HTML misses server-side access control logic.

4. API Key Security

   What is a major security risk if an API does not verify the source or permissions of an incoming API key?

   1. Anyone with the key can access the API’s protected resources
   2. The API’s response size will increase significantly
   3. Requests will be automatically blocked by firewalls
   4. The API keys will expire more rapidly

   Explanation: If source or permission checks are skipped, possession of a valid API key is enough to access protected resources, leading to unauthorized use. API response size and rapid key expiry are unrelated to authentication issues. Automatic firewall blocking may not occur if the key seems valid, making permission enforcement crucial.

5. Common Authorization Flaws

   While testing an API, you discover that authenticated users can submit requests on behalf of other users by changing user IDs in the request body. What vulnerability does this illustrate?

   1. Insecure direct object references
   2. SQL injection vulnerability
   3. Brute-force authentication attack
   4. Data validation error

   Explanation: Allowing users to access or manipulate records simply by altering an identifier reveals insecure direct object references, where authorization is not enforced for each requested object. SQL injection is about sending malicious queries. Brute-force attacks involve repeated login attempts. Data validation errors relate to input formats, not authorization.