OWASPASVS 5.0 requirement
ASVS-V10.3.1 The resource server only accepts access tokens that are intended for use with that service (audience).
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.3 OAuth Resource Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the resource server only accepts access tokens that are intended for use with that service (audience). The audience may be included in a structured access token (such as the 'aud' claim in JWT), or it can be checked using the token introspection endpoint.