OWASPASVS 5.0 requirement
ASVS-V10.5.2 The client uniquely identifies the user from id token claims, usually the 'sub' claim, which cannot be reassigned to other users (for the…
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.5 OIDC Client
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the client uniquely identifies the user from ID Token claims, usually the 'sub' claim, which cannot be reassigned to other users (for the scope of an identity provider).