OWASPASVS 5.0 requirement
ASVS-V10.4.9 Refresh tokens and reference access tokens can be revoked by an authorized user using the authorization server user interface, to mitigate…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.4 OAuth Authorization Server
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that refresh tokens and reference access tokens can be revoked by an authorized user using the authorization server user interface, to mitigate the risk of malicious clients or stolen tokens.