OWASPASVS 5.0 requirement
ASVS-V10.4.16 The client is confidential and the authorization server requires the use of strong client authentication methods (based on public-key…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the client is confidential and the authorization server requires the use of strong client authentication methods (based on public-key cryptography and resistant to replay attacks), such as mutual TLS ('tls_client_auth', 'self_signed_tls_client_auth') or private key JWT ('private_key_jwt').