API API Authentication & Security Testing 2

Question 1

What does JWT stand for in the context of API authentication?

Accepted Answer

JSON Web Token

Answer

JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit claims between client and server.

Question 2

Which part of a JWT contains the user claims and data?

Accepted Answer

Payload

Answer

The JWT Payload is the middle Base64URL-encoded section that contains the claims, such as user ID, roles, and expiration time.

Question 3

What is CORS and why is it important in API security testing?

Accepted Answer

A browser mechanism controlling cross-origin requests

Answer

CORS (Cross-Origin Resource Sharing) is a browser policy that controls which origins can call an API, preventing unauthorized cross-site requests.

Question 4

Which HTTP status code does an API return when a request lacks valid authentication credentials?

Accepted Answer

401 Unauthorized

Answer

401 Unauthorized means the request requires authentication that was not provided or is invalid.

Question 5

What is a replay attack in the context of API security?

Accepted Answer

Sending the same valid request multiple times to exploit the API

Answer

A replay attack reuses a captured valid API request (including its token) to perform unauthorized actions.

API - Testing Practice Test