OWASPASVS 5.0 requirement

ASVS-V10.4.10 Confidential client is authenticated for client-to-authorized server backchannel requests such as token requests, pushed authorization…

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V10 OAuth and OIDC
Section: V10.4 OAuth Authorization Server
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that confidential client is authenticated for client-to-authorized server backchannel requests such as token requests, pushed authorization requests (PAR), and token revocation requests.