OWASPASVS 5.0 requirement

ASVS-V10.4.4 For a given client, the authorization server only allows the usage of grants that this client needs to use.

L1 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V10 OAuth and OIDC
Section: V10.4 OAuth Authorization Server
Level: L1 (requirement applies from this verification level up)

Requirement

Verify that for a given client, the authorization server only allows the usage of grants that this client needs to use. Note that the grants 'token' (Implicit flow) and 'password' (Resource Owner Password Credentials flow) must no longer be used.