STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274849r1143900_rule
V-274849
SRG-APP-001015
SRG-APP-001015-API-001705
CAT II
10
Build or configure the API to refresh access tokens in accordance with organization-defined identification and authentication policy.
Review the API or authorization server's refresh token endpoint logic. Confirm that it validates the refresh token, checks expiration, and enforces any associated conditions like device binding or client verification.
Simulate valid and invalid refresh scenarios. Use an active refresh token to obtain a new access token and confirm that the new token includes required claims, is properly signed, and has an appropriate expiration time.
Verify the refresh process enforces client authentication, restricts token reuse (e.g., one-time-use refresh tokens if required), and aligns with the cryptographic and authentication strength.
Examine the newly issued access tokens to verify they include correct fields like exp, iat, aud, and scope, and that their validity periods are consistent with the organization's guidelines.
Consult the API or identity provider documentation and configuration to verify refresh behavior is implemented in accordance with the defined organizational standards.
If any misconfigurations are identified, this is a finding.
V-274849
False
SRG-APP-001015-API-001705
Review the API or authorization server's refresh token endpoint logic. Confirm that it validates the refresh token, checks expiration, and enforces any associated conditions like device binding or client verification.
Simulate valid and invalid refresh scenarios. Use an active refresh token to obtain a new access token and confirm that the new token includes required claims, is properly signed, and has an appropriate expiration time.
Verify the refresh process enforces client authentication, restricts token reuse (e.g., one-time-use refresh tokens if required), and aligns with the cryptographic and authentication strength.
Examine the newly issued access tokens to verify they include correct fields like exp, iat, aud, and scope, and that their validity periods are consistent with the organization's guidelines.
Consult the API or identity provider documentation and configuration to verify refresh behavior is implemented in accordance with the defined organizational standards.
If any misconfigurations are identified, this is a finding.
M
5703