Broken Authentication

Summary

Weaknesses in login mechanisms — weak password policies, exposed session tokens, missing rate limiting on login attempts — that let attackers bypass or hijack authentication entirely.

• 1Test a practice app's login for weak password requirements or missing rate limiting.
• 2Learn why session tokens should be regenerated after login (preventing session fixation).
• 3Understand credential stuffing as a common real-world exploitation of broken authentication.