OWASPASVS 5.0 requirement
ASVS-V10.4.6 Verify that, if the code grant is used, the authorization server mitigates authorization code interception attacks by requiring proof key…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that, if the code grant is used, the authorization server mitigates authorization code interception attacks by requiring proof key for code exchange (PKCE). For authorization requests, the authorization server must require a valid 'code_challenge' value and must not accept a 'code_challenge_method' value of 'plain'. For a token request, it must require validation of the 'code_verifier' parameter.