OWASPASVS 5.0 requirement
ASVS-V10.3.3 If an access control decision requires identifying a unique user from an access token (jwt or related token introspection response), the…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.3 OAuth Resource Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that if an access control decision requires identifying a unique user from an access token (JWT or related token introspection response), the resource server identifies the user from claims that cannot be reassigned to other users. Typically, it means using a combination of 'iss' and 'sub' claims.