OWASPASVS 5.0 requirement
ASVS-V10.4.14 The authorization server issues only sender-constrained (proof-of-possession) access tokens, either with certificate-bound access tokens…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the authorization server issues only sender-constrained (Proof-of-Possession) access tokens, either with certificate-bound access tokens using mutual TLS (mTLS) or DPoP-bound access tokens (Demonstration of Proof of Possession).