OWASPASVS 5.0 requirement

ASVS-V9.1.1 Self-contained tokens are validated using their digital signature or mac to protect against tampering before accepting the token's contents.

L1 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V9 Self-contained Tokens
Section: V9.1 Token source and integrity
Level: L1 (requirement applies from this verification level up)

Requirement

Verify that self-contained tokens are validated using their digital signature or MAC to protect against tampering before accepting the token's contents.