OWASPASVS 5.0 requirement
ASVS-V6.8.1 Verify that, if the application supports multiple identity providers (idps), the user's identity cannot be spoofed via another supported…
- Standard
- OWASP ASVS 5.0
- Chapter
- V6 Authentication
- Section
- V6.8 Authentication with an Identity Provider
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that, if the application supports multiple identity providers (IdPs), the user's identity cannot be spoofed via another supported identity provider (eg. by using the same user identifier). The standard mitigation would be for the application to register and identify the user using a combination of the IdP ID (serving as a namespace) and the user's ID in the IdP.