OWASPASVS 5.0 requirement
ASVS-V10.2.2 Verify that, if the oauth client can interact with more than one authorization server, it has a defense against mix-up attacks.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.2 OAuth Client
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that, if the OAuth client can interact with more than one authorization server, it has a defense against mix-up attacks. For example, it could require that the authorization server return the 'iss' parameter value and validate it in the authorization response and the token response.