Documentation - V-274845

Title

The API must time-restrict assertions in accordance with organization-defined identification and authentication policy.

Description

<VulnDiscussion>An API must time-restrict assertions to minimize security risks and ensure access to protected resources is granted only within a valid and controlled timeframe. Assertions, such as JWTs or SAML tokens, typically include expiration timestamps that limit how long they are valid. This prevents long-term misuse in case a token is leaked or intercepted and helps enforce periodic re-authentication or authorization checks. By applying time restrictions, the API reduces the window of op...

Fix Text (Documentation Requirement)

Build or configure the API to time-restrict assertions in accordance with organization-defined identification and authentication policy.