An in-depth analysis of common JSON Web Token (JWT) mistakes, basic auth, long-lived tokens, and quick, high-impact fixes to secure your APIs . Introduction APIs are the backbone of modern digital services—from mobile apps and e-commerce to banking and IoT. That scale and utility also make them prime targets. In our recent study of authentication-related findings across customers, the Imperva API Security team saw a consistent pattern: small auth misconfigurations create big exposure. Below we summarize the top authentication risks we observed, why they happen, and practical remediation steps teams can apply immediately. Key findings (share of all auth vulnerabilities) Figure: Auth Risk Distribution JSON Web Token (JWT) containing sensitive data — 46% Developers commonly put names, contact details, addresses, IPs, financial data (account numbers, card details, CVV), automotive identifiers (VINs), and government IDs into JWT payloads. When tokens leak or are logged, that data becomes exposed. Why: Convenience, lack of data-minimization, poor logging practices, and confusion between base64 encoding and encryption. Fix: Remove PII from tokens — store only minimal identifiers (e.g., token ID) and fetch sensitive data server-side. Scrub logs and telemetry of token payloads. ****JSON Web Token (JWT) with long TTLs — 21% **** Long-lived tokens increase the window for replay or theft. Why: UX tradeoffs, use of single master tokens instead of session tokens, missing refresh…Read More
Imperva API Security: Authentication Risk Report—Key Findings & Fixes
