Token-based Session Management
V3.5.1
Verify the application allows users to revoke OAuth tokens that form trust relationships with linked applications.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 290
V3.5.2
Verify the application uses session tokens rather than static API secrets and keys, except with legacy implementations.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 798
V3.5.3
Verify that stateless session tokens use digital signatures, encryption, and other countermeasures to protect against tampering, enveloping, replay, null cipher, and key substitution attacks.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 345
Disclaimer:
Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.
