Generic OAuth and OIDC Security
V10.1.1
Verify that tokens are only sent to components that strictly need them. For example, when using a backend-for-frontend pattern for browser-based JavaScript applications, access and refresh tokens shall only be accessible for the backend.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 115, 180, 207, 21, 22, 31, 37, 554, 57, 633
V10.1.2
Verify that the client only accepts values from the authorization server (such as the authorization code or ID Token) if these values result from an authorization flow that was initiated by the same user agent session and transaction. This requires that client-generated secrets, such as the proof key for code exchange (PKCE) 'code_verifier', 'state' or OIDC 'nonce', are not guessable, are specific to the transaction, and are securely bound to both the client and the user agent session in which the transaction was started.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 115, 180, 21, 22, 554, 57, 633
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
