One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue.
After it's confirmed the user is who they say they are, it then makes a call to another API on another server (let's call it layer Red). I'm not sure why he doesn't just call one layer directly but assume there was a good reason for this "Mirroring".
He said he prevents someone from calling layer red directly, and that only layer blue can call it. I asked him how and he said windows basic authentication.
I didn't even look yet at his IIS, etc, but assume there is some basic auth setup.
What are some risks that come to mind in a scenario like this?