How simple authentication and Token based authentication differs?

Question

I am a newbie in security testing. For some projects, my Project Manager asks me to do a security check. For basic security, I do check whether sensitive data is stored in cookies and whether all the information stored in them is encrypted.

My current site implements SSO. When I check the post request it sends the parameters:

1. RequestVerificationToken
2. Mobile No
3. Password
4. X-Requested-With

The weird thing is that if I use different value of RequestVerificationToken and do the post request manually via postman or jmeter, it allows me to do the same.

So my questions are:

• What is the use of this token here?
• How can I be sure that my site authentication is secure?
• What are other things I can test in cookies and get and post request?

Answer 1

This is not a good sign. Try using the request from another machine, send any token, or try without any token. If it works, then you have an issue.

Also be sure that the request receiver is configured to require authentication (sometimes the user is given the ability to turn the authentication off).

Also, usually there are user roles, and every role has a specific token to use, so try using the token for one role to do another role's operations.

You might also want to test without using Postman (maybe using code) because postman is not 100% reliable, there are things that you can not do using postman and can do using code.