Consent Management
V10.7.1
Verify that the authorization server ensures that the user consents to each authorization request. If the identity of the client cannot be assured, the authorization server must always explicitly prompt the user for consent.
Required for Level 2 and 3
Related CAPEC™ Requirements
V10.7.2
Verify that when the authorization server prompts for user consent, it presents sufficient and clear information about what is being consented to. When applicable, this should include the nature of the requested authorizations (typically based on scope, resource server, Rich Authorization Requests (RAR) authorization details), the identity of the authorized application, and the lifetime of these authorizations.
Required for Level 2 and 3
Related CAPEC™ Requirements
V10.7.3
Verify that the user can review, modify, and revoke consents which the user has granted through the authorization server.
Required for Level 2 and 3
Related CAPEC™ Requirements
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
