api-auth-and-jwt-abuse

To test JWT claim validation, audit bearer token fields including alg, kid, jku, x5u, issuer, and audience to detect verification failures. Review privilege claims and key metadata to uncover authorization weaknesses caused by trusting spoofable token metadata.

Find API rate-limit bypass and GraphQL batch abuse vulnerabilities by probing quota and rate-limit controls alongside GraphQL and JSON batch endpoints. Test mass assignment candidates and batched mutation patterns to identify broken batching controls.

Test header spoofing to bypass API authentication boundaries by manipulating identity-related headers like X-Forwarded-For, X-Real-IP, and Forwarded. Explore method and path variants to find inconsistent enforcement and auth boundary bypasses caused by trusting spoofable request identity signals.

Audit an API for bearer token and API key authentication flaws by reviewing token field triage, claim misuse, and header spoofing. Test token-associated metadata and spoofable identity signals to detect verification and boundary failures across endpoints.

Check JWT key metadata like jku and x5u headers during security testing when verifying token trust boundaries and key injection risks. Reviewing these fields alongside alg and kid parameters helps detect verification failures caused by trusting external key sources or manipulated algorithms.