STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274847r1143896_rule
V-274847
SRG-APP-001005
SRG-APP-001005-API-001695
CAT II
10
Build or configure the API to generate access tokens in accordance with organization-defined identification and authentication policy.
Review the organization's identification and authentication policy to understand requirements for access token generation, including allowed token types, token claims, encryption/signature requirements, and conditions under which tokens may be issued.
Examine the API or authentication server code/configuration responsible for token issuance. Verify it enforces authentication of clients or users before issuing a token and that it includes required attributes (e.g., subject ID, roles, scopes) based on the policy.
Generate tokens using valid authentication requests and inspect their structure and contents. Confirm the issued tokens include the proper claims, are correctly signed/encrypted, and match the formatting (e.g., JWT) required by policy.
Attempt to obtain tokens under various conditions, including successful and failed login attempts, and with different scopes or resource requests. Confirm tokens are only issued in compliance with authentication success and policy-based restrictions.
If the API uses an identity provider (IdP) or API Gateway for token generation, review those configurations to verify they enforce organizational policies during token issuance.
If the API does not generate access tokens in accordance with organization-defined identification and authentication policy, this is a finding.
V-274847
False
SRG-APP-001005-API-001695
Review the organization's identification and authentication policy to understand requirements for access token generation, including allowed token types, token claims, encryption/signature requirements, and conditions under which tokens may be issued.
Examine the API or authentication server code/configuration responsible for token issuance. Verify it enforces authentication of clients or users before issuing a token and that it includes required attributes (e.g., subject ID, roles, scopes) based on the policy.
Generate tokens using valid authentication requests and inspect their structure and contents. Confirm the issued tokens include the proper claims, are correctly signed/encrypted, and match the formatting (e.g., JWT) required by policy.
Attempt to obtain tokens under various conditions, including successful and failed login attempts, and with different scopes or resource requests. Confirm tokens are only issued in compliance with authentication success and policy-based restrictions.
If the API uses an identity provider (IdP) or API Gateway for token generation, review those configurations to verify they enforce organizational policies during token issuance.
If the API does not generate access tokens in accordance with organization-defined identification and authentication policy, this is a finding.
M
5703