Federated Re-authentication
V3.6.1
Verify that Relying Parties (RPs) specify the maximum authentication time to Credential Service Providers (CSPs) and that CSPs re-authenticate the user if they haven't used a session within that period.
Level 1 required: False
Level 2 required: False
Level 3 required: True
CWE: 613
V3.6.2
Verify that Credential Service Providers (CSPs) inform Relying Parties (RPs) of the last authentication event, to allow RPs to determine if they need to re-authenticate the user.
Level 1 required: False
Level 2 required: False
Level 3 required: True
CWE: 613
Disclaimer:
Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.
