Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The API must audience-restrict access tokens in accordance with organization-defined identification and authentication policy.
Description
Discussion Text
An API must audience-restrict access tokens to ensure tokens can only be used by the intended recipient or service. Audience restriction involves embedding an "audience" claim in the token, which specifies the exact API or service authorized to accept it.
Without an API gateway to enforce this, the API itself must validate the audience claim to prevent tokens from being used maliciously by unauthorized services. This restriction helps protect the API from unauthorized access and ensures that tokens are not intercepted and misused in other parts of the system, enhancing overall security by limiting the scope of each token to its intended purpose.
Without an API gateway to enforce this, the API itself must validate the audience claim to prevent tokens from being used maliciously by unauthorized services. This restriction helps protect the API from unauthorized access and ensures that tokens are not intercepted and misused in other parts of the system, enhancing overall security by limiting the scope of each token to its intended purpose.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.