OWASPASVS 5.0 requirement
ASVS-V10.4.15 Verify that, for a server-side client (which is not executed on the end-user device), the authorization server ensures that the…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that, for a server-side client (which is not executed on the end-user device), the authorization server ensures that the 'authorization_details' parameter value is from the client backend and that the user has not tampered with it. For example, by requiring the usage of pushed authorization request (PAR) or JWT-secured Authorization Request (JAR).