Token source and integrity
V9.1.1
Verify that self-contained tokens are validated using their digital signature or MAC to protect against tampering before accepting the token's contents.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 145, 21, 473, 475, 57, 94
V9.1.2
Verify that only algorithms on an allowlist can be used to create and verify self-contained tokens, for a given context. The allowlist must include the permitted algorithms, ideally only either symmetric or asymmetric algorithms, and must not include the 'None' algorithm. If both symmetric and asymmetric must be supported, additional controls will be needed to prevent key confusion.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 145, 21, 473, 475, 57, 94
V9.1.3
Verify that key material that is used to validate self-contained tokens is from trusted pre-configured sources for the token issuer, preventing attackers from specifying untrusted sources and keys. For JWTs and other JWS structures, headers such as 'jku', 'x5u', and 'jwk' must be validated against an allowlist of trusted sources.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 145, 21, 39, 473, 475, 57, 94
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
