OWASPASVS 5.0 requirement

ASVS-V10.5.4 The client validates that the id token is intended to be used for that client (audience) by checking that the 'aud' claim from the token is…

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V10 OAuth and OIDC
Section: V10.5 OIDC Client
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that the client validates that the ID Token is intended to be used for that client (audience) by checking that the 'aud' claim from the token is equal to the 'client_id' value for the client.