OAuth Resource Server
V10.3.1
Verify that the resource server only accepts access tokens that are intended for use with that service (audience). The audience may be included in a structured access token (such as the 'aud' claim in JWT), or it can be checked using the token introspection endpoint.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 180, 21, 22, 39, 57, 633
V10.3.2
Verify that the resource server enforces authorization decisions based on claims from the access token that define delegated authorization. If claims such as 'sub', 'scope', and 'authorization_details' are present, they must be part of the decision.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 180, 21, 57, 633
V10.3.3
Verify that if an access control decision requires identifying a unique user from an access token (JWT or related token introspection response), the resource server identifies the user from claims that cannot be reassigned to other users. Typically, it means using a combination of 'iss' and 'sub' claims.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 180, 21, 57, 633
V10.3.4
Verify that, if the resource server requires specific authentication strength, methods, or recentness, it verifies that the presented access token satisfies these constraints. For example, if present, using the OIDC 'acr', 'amr' and 'auth_time' claims respectively.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 180, 21, 57, 633
V10.3.5
Verify that the resource server prevents the use of stolen access tokens or replay of access tokens (from unauthorized parties) by requiring sender-constrained access tokens, either Mutual TLS for OAuth 2 or OAuth 2 Demonstration of Proof of Possession (DPoP).
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 180, 21, 22, 57, 633
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
