OWASPASVS 5.0 requirement
ASVS-V10.3.2 The resource server enforces authorization decisions based on claims from the access token that define delegated authorization.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.3 OAuth Resource Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the resource server enforces authorization decisions based on claims from the access token that define delegated authorization. If claims such as 'sub', 'scope', and 'authorization_details' are present, they must be part of the decision.