STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must audience-restrict access tokens in accordance with organization-defined identification and authentication policy.

DISA Rule

SV-274712r1143748_rule

Vulnerability Number

V-274712

Group Title

SRG-APP-000441

Rule Version

SRG-APP-000441-API-001020

Severity

CAT II

CCI(s)

• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.

Weight

10

Fix Recommendation

Build or configure the API to audience restrict access tokens in accordance with organization-defined identification and authentication policy.

Check Contents

Review the API's token issuance process, specifically for access tokens (e.g., JWTs or OAuth2 tokens).

Inspect the aud (audience) claim in the access tokens to verify that it is present and correctly populated with the intended audience identifier(s).

Confirm that audience restrictions align with the organization's identification and authentication policy, ensuring that tokens are scoped only to authorized APIs, services, or clients.

Review access control and validation logic in the API or resource server to ensure that incoming tokens are validated against the expected audience value.

Interview the system owner or developer to verify how audience values are defined, issued, and enforced.

If access tokens are not audience-restricted or if the audience values do not comply with the organization-defined policy, this is a finding.

Vulnerability Number

V-274712

Documentable

False

Rule Version

SRG-APP-000441-API-001020

Severity Override Guidance

Review the API's token issuance process, specifically for access tokens (e.g., JWTs or OAuth2 tokens).

Inspect the aud (audience) claim in the access tokens to verify that it is present and correctly populated with the intended audience identifier(s).

Confirm that audience restrictions align with the organization's identification and authentication policy, ensuring that tokens are scoped only to authorized APIs, services, or clients.

Review access control and validation logic in the API or resource server to ensure that incoming tokens are validated against the expected audience value.

Interview the system owner or developer to verify how audience values are defined, issued, and enforced.

If access tokens are not audience-restricted or if the audience values do not comply with the organization-defined policy, this is a finding.

Check Content Reference

M

Target Key

5703