OWASPASVS 5.0 requirement
ASVS-V9.2.2 The service receiving a token validates the token to be the correct type and is meant for the intended purpose before accepting the token's…
- Standard
- OWASP ASVS 5.0
- Chapter
- V9 Self-contained Tokens
- Section
- V9.2 Token content
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the service receiving a token validates the token to be the correct type and is meant for the intended purpose before accepting the token's contents. For example, only access tokens can be accepted for authorization decisions and only ID Tokens can be used for proving user authentication.