OWASPASVS 5.0 requirement

ASVS-V10.1.1 Tokens are only sent to components that strictly need them.

L2 Published 2025 Official page ↗
Standard
OWASP ASVS 5.0
Chapter
V10 OAuth and OIDC
Section
V10.1 Generic OAuth and OIDC Security
Level
L2 (requirement applies from this verification level up)

Requirement

Verify that tokens are only sent to components that strictly need them. For example, when using a backend-for-frontend pattern for browser-based JavaScript applications, access and refresh tokens shall only be accessible for the backend.