OWASPASVS 5.0 requirement
ASVS-V10.5.1 The client (as the relying party) mitigates id token replay attacks.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.5 OIDC Client
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the client (as the relying party) mitigates ID Token replay attacks. For example, by ensuring that the 'nonce' claim in the ID Token matches the 'nonce' value sent in the authentication request to the OpenID Provider (in OAuth2 refereed to as the authorization request sent to the authorization server).