OWASPASVS 5.0 requirement
ASVS-V10.6.1 The openid provider only allows values 'code', 'ciba', 'id_token', or 'id_token code' for response mode.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.6 OpenID Provider
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the OpenID Provider only allows values 'code', 'ciba', 'id_token', or 'id_token code' for response mode. Note that 'code' is preferred over 'id_token code' (the OIDC Hybrid flow), and 'token' (any Implicit flow) must not be used.