> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/bug-bounty/broken-authentication.md).

# Broken Authentication

## Login Page Bypass using X-Forwarded-For

We can sometimes bypass Login Pages and Authentication Mechanisms using X-Forwarded-For Header

Below when i entered the credentials i got **Invalid Credentials** Error

<figure><img src="/files/qtqE7VN6gMdsgs56rHAA" alt=""><figcaption></figcaption></figure>

Now i will add the **X-Forwarded-For Header** and it will bypass it

<figure><img src="/files/QDXOZsJ5fOg0UqZLj7Mw" alt=""><figcaption></figcaption></figure>