Documentation - V-274840

Title

The API must protect the private keys used to sign assertions and tokens.

Description

<VulnDiscussion>Private keys are used to sign tokens and assertions, which verify the identity and permissions of users or systems requesting access. If these keys are compromised, attackers could generate fraudulent tokens or assertions, granting unauthorized access to sensitive resources and potentially causing significant damage to both the system and its users. The level of protection required for these private keys depends on the sensitivity of the information and the potential impact of ...

Fix Text (Documentation Requirement)

Build or configure the API to properly protect private keys used to sign assertions and tokens.