API Authentication Failures: Checks to Run Before You Blame the Rate Limiter

Broken object-level authorization, missing authentication on internal endpoints and unlimited credential guessing appear repeatedly in the OWASP API Security Top 10. The failures share a structure: the endpoint exists, the documentation describes it, and no control sits in front of it.

Authentication versus authorization

An endpoint that verifies a token is authenticated. An endpoint that verifies the token belongs to a subject allowed to act on the specific object is authorized.…