OpenID Provider from ASVS framework

SAMMY UI is optimized for resolutions with a width 1024px and higher.

Encoding and Sanitization
Validation and Business Logic
Web Frontend Security
API and Web Service
File Handling
Authentication
Session Management
Authorization
Self-contained Tokens
- Token source and integrity
- Token content
OAuth and OIDC
Cryptography
Secure Communication
Configuration
Data Protection
Secure Coding and Architecture
Security Logging and Error Handling
WebRTC
- TURN Server
- Media
- Media

V10.6.1

V10.6.1: Verify that the OpenID Provider only allows values 'code', 'ciba', 'id_token', or 'id_token code' for response mode. Note that 'code' is preferred over 'id_token code' (the OIDC Hybrid flow), and 'token' (any Implicit flow) must not be used.

V10.6.2

V10.6.2: Verify that the OpenID Provider mitigates denial of service through forced logout. By obtaining explicit confirmation from the end-user or, if present, validating parameters in the logout request (initiated by the relying party), such as the 'id_token_hint'.