Q18: Broken Authentication & Credential Stuffing: Brute force defense, rate limiting, and password leak APIs. - Web Security & OWASP (50 Qs)

Modern Authentication Defense

Credential Stuffing is the automated testing of billions of stolen username/password pairs from third-party data breaches against login endpoints.

sql

[ Attacker Botnet ] ---> Floods POST /api/login with 50,000 attempts/min
                                     |
                                     v
+-------------------------------------------------------------------------------+
|                        Authentication Defense Pipeline                        |
|                                                                               |
|   1. IP-Level Rate Limit       -> Max 10 attempts per minute per IP           |
|   2. User-Level Rate Limit     -> Max 5 consecutive failed attempts per user  |
|   3. CAPTCHA Adaptive Step-Up  -> Trigger Turnstile after 3 failed attempts  |
|   4. HaveIBeenPwned API Check  -> Block breached passwords at registration   |
|   5. Phishing-Resistant MFA    -> FIDO2 / WebAuthn / Passkeys                 |
+-------------------------------------------------------------------------------+

Checking Compromised Passwords via k-Anonymity

Never send cleartext user passwords to third-party verification APIs. Use the k-Anonymity model provided by the Pwned Passwords API:

Hash password locally with SHA-1: password123 → CBFDAC6008F9CAB4083784CBD1874F76618D2A97.
Extract the first 5 characters: CBFDA.
Query API: GET https://api.pwnedpasswords.com/range/CBFDA.
API returns list of hash suffixes that share that prefix.
If the remaining suffix matches, reject the password as compromised!