OWASPASVS 5.0 requirement
ASVS-V10.2.1 Verify that, if the code flow is used, the oauth client has protection against browser-based request forgery attacks, commonly known as…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.2 OAuth Client
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that, if the code flow is used, the OAuth client has protection against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF), which trigger token requests, either by using proof key for code exchange (PKCE) functionality or checking the 'state' parameter that was sent in the authorization request.