Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Authentication is the process of determining if a claimed identity is correct. When authentication is insufficient or incorrect, attackers can assume the identity of legitimate users.
How to fix this vulnerability
Prevention strategies for Improper Authentication based on 2 Shoulder detection rules.
Use jwt.verify() instead of jwt.decode() when assigning user identity
- const decoded = jwt.decode(token); + const decoded = jwt.verify(token, process.env.JWT_SECRET, { + algorithms: ['HS256'] + }); req.user = decoded;
Use early returns for authentication failures and constant-time comparison
from flask import request, jsonify - - @app.route('/login', methods=['POST']) - def login(): - user = User.query.filter_by(username=request.json['username']).first() - if user and user.password == request.json['password']: - return jsonify({'token': generate_token(user)}) - return jsonify({'error': 'Invalid'}), 401 + from werkzeug.security import check_password_hash + + @app.route('/login', methods=['POST']) + def login(): + user = User.query.filter_by(username=request.json['username']).first() + if not user or not check_password_hash(user.password_hash, request.json['password']): + return jsonify({'error': 'Invalid credentials'}), 401 + return jsonify({'token': generate_token(user)})
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Improper Authentication patterns. 2 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=287 # Or scan entire project npx @shoulderdev/cli trust .
Detection Rules (2)
What to watch for in code reviews
These patterns indicate potential Improper Authentication vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Improper Authentication
Shoulder CLI finds vulnerable patterns across your entire codebase.