OWASPASVS 5.0 requirement
ASVS-V10.3.5 The resource server prevents the use of stolen access tokens or replay of access tokens (from unauthorized parties) by requiring…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.3 OAuth Resource Server
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the resource server prevents the use of stolen access tokens or replay of access tokens (from unauthorized parties) by requiring sender-constrained access tokens, either Mutual TLS for OAuth 2 or OAuth 2 Demonstration of Proof of Possession (DPoP).