STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274844r1143890_rule
V-274844
SRG-APP-000990
SRG-APP-000990-API-001680
CAT II
10
Build or configure the API to revoke assertions in accordance with organization-defined identification and authentication policy.
Verify that the API has an implemented and functional revocation mechanism. This could involve endpoints or methods that allow for the invalidation of assertions, such as a revocation list or a central system for tracking revoked assertions.
Simulate the revocation of assertions by either manually revoking access or simulating scenarios that trigger revocation (e.g., a user's session being terminated, access being revoked due to a policy violation). Ensure the API properly invalidates the assertions and prevents further access with the revoked assertions.
Review Logging and Auditing of Revocation Events:
Confirm that the API logs revocation events, capturing key details such as who initiated the revocation, when it occurred, and why it was revoked.
After revocation, test that any attempt to use the revoked assertion is properly rejected by the API. The API should deny access if the assertion has been invalidated, ensuring no further use is possible.
Refer to the API's documentation to confirm that revocation processes are correctly implemented in line with the organization's defined policies for identity management and authentication.
If the API does not revoke assertions in accordance with organization-defined identification and authentication policy, this is a finding.
V-274844
False
SRG-APP-000990-API-001680
Verify that the API has an implemented and functional revocation mechanism. This could involve endpoints or methods that allow for the invalidation of assertions, such as a revocation list or a central system for tracking revoked assertions.
Simulate the revocation of assertions by either manually revoking access or simulating scenarios that trigger revocation (e.g., a user's session being terminated, access being revoked due to a policy violation). Ensure the API properly invalidates the assertions and prevents further access with the revoked assertions.
Review Logging and Auditing of Revocation Events:
Confirm that the API logs revocation events, capturing key details such as who initiated the revocation, when it occurred, and why it was revoked.
After revocation, test that any attempt to use the revoked assertion is properly rejected by the API. The API should deny access if the assertion has been invalidated, ensuring no further use is possible.
Refer to the API's documentation to confirm that revocation processes are correctly implemented in line with the organization's defined policies for identity management and authentication.
If the API does not revoke assertions in accordance with organization-defined identification and authentication policy, this is a finding.
M
5703