Method test_api_auth

modules/apisec/auth_tester.py:67–103

Test API authentication security. Args: api: Parsed API specification Returns: Scan result with findings

(self, api: ParsedAPI)

    async def test_api_auth(self, api: ParsedAPI) -> ScanResult:
        """Test API authentication security.

        Args:
            api: Parsed API specification

        Returns:
            Scan result with findings
        """
        target = Target.from_string(api.base_url)
        self.logger.info(f"Testing authentication for {api.title}")

        findings = []

        # Test authentication bypass
        bypass_findings = await self._test_auth_bypass(api)
        findings.extend(bypass_findings)

        # Test for broken authentication
        broken_auth_findings = await self._test_broken_auth(api)
        findings.extend(broken_auth_findings)

        # Test JWT security if applicable
        jwt_findings = self._analyze_jwt_security(api)
        findings.extend(jwt_findings)

        # Test rate limiting on auth endpoints
        rate_limit_findings = await self._test_auth_rate_limiting(api)
        findings.extend(rate_limit_findings)

        return ScanResult(
            module="apisec.auth_tester",
            target=target,
            success=True,
            findings=findings,
            data={"api_title": api.title},
        )

    async def _test_auth_bypass(self, api: ParsedAPI) -> list[Finding]:
        """Test for authentication bypass vulnerabilities."""
        findings = []