Vulnerabilities
App Auth Paths vs Website Login Pages
March 10, 2022
App auth paths vs website login pages is a surface split. A marketing /login or CMS /wp-login.php is a document. App origins expose /api, /oauth, /auth, /graphql, and /v1 — discoverability plus 401/403 behavior. Presence is normal. 401/403 is healthy. 200 on an authenticated JSON API without credentials is the miss. RoastMyOpsec app mode uses gentle path probes for status codes. No credential stuffing. Website mode still belongs on the brochure host.
The practical difference
Website login is often a form and cookies. App auth is tokens, OAuth redirects, and JSON. They fail differently: the site misses MFA on WordPress; the app misses rate limits on /oauth/token or leaves GraphQL wide open.
Many products put the costume on www and the sessions on app. Scanning only www is how API doors stay lonely.
How to choose what to scan
Run website mode on the marketing hostname. Run app mode on the origin that serves APIs. If one host does both, run website first for headers, then app for CORS, methods, errors, and auth paths.
| Path class | Better mode | Healthy signal | Takeaway |
|---|---|---|---|
| /login, /wp-admin | Website (also see admin guide) | MFA + rate limits | Discoverability ≠ breach |
| /api, /v1 | App | 401/403 without a body novel | Pair with verbose-errors guide |
| /oauth, /auth | App | Rate limits, bot fights, MFA | This is where stuffing lands |
| /graphql | App | No public schema dump | See introspection guide |
When 200 on /api is still fine
A public health endpoint or unauthenticated read API can 200 on purpose. The roast is about whether that body should be public and whether errors still leak internals. Do not confuse a documented public API with an accidentally open admin router.
Common mistakes
The first mistake is hardening www and leaving api. on the origin IP.
The second mistake is rate-limiting /login HTML and not /oauth/token.
The third mistake is treating 401 as a failure instead of a healthy lock.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a public /api path a vulnerability?
- No. APIs are supposed to be reachable. The question is authorization, abuse controls, and error hygiene on those paths.
- Should I hide /oauth with robots.txt?
- No. That advertises it and does not authenticate anyone. See robots vs access control.
- How does RoastMyOpsec probe auth paths?
- Soft GETs for presence and status. No password spraying, no credential stuffing.