OWASPASVS 5.0 requirement

ASVS-V10.7.2 When the authorization server prompts for user consent, it presents sufficient and clear information about what is being consented to.

L2 Published 2025 Official page ↗
Standard
OWASP ASVS 5.0
Chapter
V10 OAuth and OIDC
Section
V10.7 Consent Management
Level
L2 (requirement applies from this verification level up)

Requirement

Verify that when the authorization server prompts for user consent, it presents sufficient and clear information about what is being consented to. When applicable, this should include the nature of the requested authorizations (typically based on scope, resource server, Rich Authorization Requests (RAR) authorization details), the identity of the authorized application, and the lifetime of these authorizations.