Address API2:2023 Broken Authentication + token management per OWASP API Security Top 10 2023. Broken Authentication occurs when authentication mechanisms are weak + improperly implemented + or bypassable. Mitigations include (a) implement strong authentication (OAuth 2.0 + OIDC + FAPI 2.0 where applicable) + (b) require multi-factor authentication for sensitive operations + privileged accounts + (c) implement rate limiting + account lockout against brute force + credential stuffing, (d) use short-lived access tokens + refresh token rotation + sender-constrained tokens (DPoP + mTLS), (e) protect against session fixation + replay + token theft + (f) maintain secure token storage on client + server, (g) implement proper session termination + logout including all-device logout. Secret and Token Management for APIs (OWASP-API-PRG-04) must (a) maintain secrets in dedicated secret store + (b) rotate regularly + (c) avoid hard-coded secrets + (d) audit secret access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.