API Authentication & Security Testing

// JWT Token Structure
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

// Decoded:
// Header
{
  "alg": "HS256",    // Algorithm
  "typ": "JWT"       // Token type
}

// Payload
{
  "sub": "1234567890",           // Subject (user ID)
  "name": "John Doe",            // Custom claims
  "role": "admin",
  "iat": 1516239022,             // Issued at (timestamp)
  "exp": 1516242622              // Expiration (timestamp)
}

// Signature = HMACSHA256(
//   base64(header) + "." + base64(payload),
//   secret_key
// )

// 1. Login - Get JWT Token
POST /api/auth/login
Content-Type: application/json

{
  "email": "[email protected]",
  "password": "SecurePass123!"
}

Response: 200 OK
{
  "token": "eyJhbGc...",
  "refresh_token": "eyJhbGc...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

// 2. Use Token for Protected Endpoint
GET /api/users/me
Authorization: Bearer eyJhbGc...

Response: 200 OK
{
  "id": "123",
  "name": "John Doe",
  "email": "[email protected]"
}

// 3. Try Without Token
GET /api/users/me

Response: 401 Unauthorized
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

// 4. Try With Invalid Token
GET /api/users/me
Authorization: Bearer invalid_token

Response: 401 Unauthorized
{
  "error": {
    "code": "INVALID_TOKEN",
    "message": "Invalid or malformed token"
  }
}

// Step 1: Redirect user to authorization endpoint
GET /oauth/authorize?
  response_type=code&
  client_id=YOUR_CLIENT_ID&
  redirect_uri=https://yourapp.com/callback&
  scope=read:profile,write:posts&
  state=random_state_string

// User logs in and approves...

// Step 2: Authorization server redirects back with code
GET https://yourapp.com/callback?
  code=AUTH_CODE_HERE&
  state=random_state_string

// Step 3: Exchange code for access token
POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=AUTH_CODE_HERE&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
redirect_uri=https://yourapp.com/callback

Response: 200 OK
{
  "access_token": "ya29.a0AfH6...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "1//0gJw...",
  "scope": "read:profile write:posts"
}

// Step 4: Use access token
GET /api/user/profile
Authorization: Bearer ya29.a0AfH6...

Response: 200 OK
{
  "id": "123",
  "name": "John Doe",
  "email": "[email protected]"
}

// Rate limit exceeded response
Response: 429 Too Many Requests
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1641902400

{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Too many requests. Retry after 60 seconds."
  }
}

// User A (authenticated) tries to access User B's data
GET /api/users/456/profile
Authorization: Bearer [User A's token]

Response: 403 Forbidden
{
  "error": {
    "code": "FORBIDDEN",
    "message": "You don't have permission to access this resource"
  }
}

// Admin can access any user
GET /api/users/456/profile
Authorization: Bearer [Admin token]

Response: 200 OK
{ "id": 456, "name": "User B", ... }

// Test Cases:
// ✓ Users can only access their own data
// ✓ Admins can access all data
// ✓ Roles are properly enforced
// ✓ Can't escalate privileges
// ✓ Horizontal privilege escalation prevented
// ✓ Vertical privilege escalation prevented