OWASPASVS 5.0 requirement
ASVS-V10.4.3 The authorization code is short-lived.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that the authorization code is short-lived. The maximum lifetime can be up to 10 minutes for L1 and L2 applications and up to 1 minute for L3 applications.