Token source and integrity from ASVS framework

SAMMY UI is optimized for resolutions with a width 1024px and higher.

Encoding and Sanitization
Validation and Business Logic
Web Frontend Security
API and Web Service
File Handling
Authentication
Session Management
Authorization
Self-contained Tokens
- Token source and integrity
- Token content
OAuth and OIDC
Cryptography
Secure Communication
Configuration
Data Protection
Secure Coding and Architecture
Security Logging and Error Handling
WebRTC
- TURN Server
- Media
- Media

V9.1: Token source and integrity V9.2: Token content

V9.1.1

V9.1.1: Verify that self-contained tokens are validated using their digital signature or MAC to protect against tampering before accepting the token's contents.

V9.1.2

V9.1.2: Verify that only algorithms on an allowlist can be used to create and verify self-contained tokens, for a given context. The allowlist must include the permitted algorithms, ideally only either symmetric or asymmetric algorithms, and must not include the 'None' algorithm. If both symmetric and asymmetric must be supported, additional controls will be needed to prevent key confusion.

V9.1.3

V9.1.3: Verify that key material that is used to validate self-contained tokens is from trusted pre-configured sources for the token issuer, preventing attackers from specifying untrusted sources and keys. For JWTs and other JWS structures, headers such as 'jku', 'x5u', and 'jwk' must be validated against an allowlist of trusted sources.