OWASPASVS 5.0 requirement

ASVS-V9.2.3 The service only accepts tokens which are intended for use with that service (audience).

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V9 Self-contained Tokens
Section: V9.2 Token content
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that the service only accepts tokens which are intended for use with that service (audience). For JWTs, this can be achieved by validating the 'aud' claim against an allowlist defined in the service.