Back to Home

Authentication Failures

A07:2021 - Broken auth mechanisms

What are Authentication Failures?

Authentication failures occur when application functions related to authentication and session management are implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens.

Common Issues:

  • No brute force protection - unlimited login attempts
  • Predictable session IDs (sequential numbers)
  • Weak password policies
  • Plaintext password storage in logs
  • No multi-factor authentication

Before WAF: Vulnerable

Without Cloudflare WAF, authentication is easily bypassed

Step 1: Brute Force Attack

# Try unlimited login attempts - no rate limiting
/api/auth-failures?action=brute-force&username=admin&password=password123

# View predictable session IDs
/api/auth-failures?action=session&user_id=1

Vulnerability: No rate limiting, predictable session IDs, passwords logged in plaintext.

After WAF: Protected

With Cloudflare WAF, brute force and automated attacks are blocked

Enable Cloudflare Protection:

  1. Go to Cloudflare Dashboard → Security → WAF
  2. Configure Rate Limiting on /api/login (5 requests per minute)
  3. Enable "Bot Fight Mode" to detect automated attacks
  4. Turn on "Super Bot Fight Mode" for advanced protection

Result: Brute force attempts are rate-limited and blocked. CAPTCHA challenges for suspicious traffic.

Cloudflare Protection

  • Rate Limiting: Block brute force attempts
  • Bot Fight Mode: Detect and block automated attacks
  • Turnstile: Invisible CAPTCHA for suspicious requests