STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API's internal authorization tokens must not be provided back to the user.

DISA Rule

SV-274679r1143712_rule

Vulnerability Number

V-274679

Group Title

SRG-APP-000400

Rule Version

SRG-APP-000400-API-000855

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Review the API and authentication codebase. Remove internal tokens being passed around or exposed at any point in the code.

Check Contents

Verify the API's internal authorization tokens are not provided back to the user.

Inspect API responses: Look at the API responses for any authorization tokens (e.g., JSON Web Tokens [JWT] tokens, session tokens, API keys) that may be included in the response body or headers. Verify sensitive tokens are not being returned as part of a successful request or error response.

Audit API documentation: Review the API documentation to see if the token is explicitly mentioned as being returned to the user.

If internal tokens are part of any public documentation for user-facing APIs, this is a finding.

Vulnerability Number

V-274679

Documentable

False

Rule Version

SRG-APP-000400-API-000855

Severity Override Guidance

Verify the API's internal authorization tokens are not provided back to the user.

Inspect API responses: Look at the API responses for any authorization tokens (e.g., JSON Web Tokens [JWT] tokens, session tokens, API keys) that may be included in the response body or headers. Verify sensitive tokens are not being returned as part of a successful request or error response.

Audit API documentation: Review the API documentation to see if the token is explicitly mentioned as being returned to the user.

If internal tokens are part of any public documentation for user-facing APIs, this is a finding.

Check Content Reference

M

Target Key

5703