OWASPASVS 5.0 requirement
ASVS-V6.6.4 Verify that, where push notifications are used for multi-factor authentication, rate limiting is used to prevent push bombing attacks.
- Standard
- OWASP ASVS 5.0
- Chapter
- V6 Authentication
- Section
- V6.6 Out-of-Band authentication mechanisms
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that, where push notifications are used for multi-factor authentication, rate limiting is used to prevent push bombing attacks. Number matching may also mitigate this risk.