STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274850r1143901_rule
V-274850
SRG-APP-001020
SRG-APP-001020-API-001710
CAT II
10
Build or configure the API to revoke access tokens in accordance with organization-defined identification and authentication policy.
Review the API or identity provider implementation to verify there is a token revocation mechanism in place (e.g., an OAuth 2.0 /revoke endpoint). Confirm it adheres to the policy by requiring appropriate authentication and validating the token before revocation.
Use an issued access token to perform API calls, then invoke the revocation process. After revocation, attempt to use the same token again. The API should reject the request, demonstrating that the token is no longer valid.
If tokens are cached or used across distributed systems, verify revocation is promptly propagated and enforced across all relevant services in accordance with policy requirements.
If the system uses a token store or blacklist, verify revoked tokens are added to it and that the API checks against it before granting access.
Consult API or identity provider documentation to confirm support for revocation features and verify they are configured to align with organizational policies.
If any misconfigurations are identified, this is a finding.
V-274850
False
SRG-APP-001020-API-001710
Review the API or identity provider implementation to verify there is a token revocation mechanism in place (e.g., an OAuth 2.0 /revoke endpoint). Confirm it adheres to the policy by requiring appropriate authentication and validating the token before revocation.
Use an issued access token to perform API calls, then invoke the revocation process. After revocation, attempt to use the same token again. The API should reject the request, demonstrating that the token is no longer valid.
If tokens are cached or used across distributed systems, verify revocation is promptly propagated and enforced across all relevant services in accordance with policy requirements.
If the system uses a token store or blacklist, verify revoked tokens are added to it and that the API checks against it before granting access.
Consult API or identity provider documentation to confirm support for revocation features and verify they are configured to align with organizational policies.
If any misconfigurations are identified, this is a finding.
M
5703