OWASPASVS 5.0 requirement
ASVS-V10.4.2 Verify that, if the authorization server returns the authorization code in the authorization response, it can be used only once for a token…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that, if the authorization server returns the authorization code in the authorization response, it can be used only once for a token request. For the second valid request with an authorization code that has already been used to issue an access token, the authorization server must reject a token request and revoke any issued tokens related to the authorization code.