V10.2.1: Verify that, if the code flow is used, the OAuth client has protection against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF), which trigger token requests, either by using proof key for code exchange (PKCE) functionality or checking the 'state' parameter that was sent in the authorization request.
ASVS Maturity
V10.2.2
V10.2.2: Verify that, if the OAuth client can interact with more than one authorization server, it has a defense against mix-up attacks. For example, it could require that the authorization server return the 'iss' parameter value and validate it in the authorization response and the token response.
ASVS Maturity
V10.2.3
V10.2.3: Verify that the OAuth client only requests the required scopes (or other authorization parameters) in requests to the authorization server.