OWASPASVS 5.0 requirement
ASVS-V6.5.5 Out-of-band authentication requests, codes, or tokens, as well as time-based one-time passwords (totps) have a defined lifetime.
- Standard
- OWASP ASVS 5.0
- Chapter
- V6 Authentication
- Section
- V6.5 General Multi-factor authentication requirements
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that out-of-band authentication requests, codes, or tokens, as well as time-based one-time passwords (TOTPs) have a defined lifetime. Out of band requests must have a maximum lifetime of 10 minutes and for TOTP a maximum lifetime of 30 seconds.