OWASPASVS 5.0 requirement
ASVS-V10.4.12 For a given client, the authorization server only allows the 'response_mode' value that this client needs to use.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that for a given client, the authorization server only allows the 'response_mode' value that this client needs to use. For example, by having the authorization server validate this value against the expected values or by using pushed authorization request (PAR) or JWT-secured Authorization Request (JAR).