OWASPASVS 5.0 requirement
ASVS-V10.4.8 Refresh tokens have an absolute expiration, including if sliding refresh token expiration is applied.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that refresh tokens have an absolute expiration, including if sliding refresh token expiration is applied.