ASVS 5.0 V10.4.4 (Level 1) says the authorization server must limit each client to the grant types that client actually needs. The implicit grant (response type token) and the resource owner password credentials grant (password) must not be used at all.
In practice that means a per-client allow list, enforced at the token endpoint and the authorization endpoint, with those two legacy grants removed from the server.
Why it matters
Every enabled grant is attack surface. A single page app that only needs the authorization code grant has no reason to be allowed to use client credentials. If its client ID leaks or an XSS bug appears, a broader grant list lets an attacker pick the weakest route.
The two banned grants are banned for good reasons. The implicit grant puts access tokens in URL fragments, where history, extensions and scripts can read them. The password grant makes the client handle the user's real password, which defeats MFA and phishing resistant login and trains users to type credentials into third party apps.
How to implement it
Register grants per client and reject anything else. A Keycloak style client export shows the idea.
{
"clientId": "orders-web",
"publicClient": true,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false
}
If you wrote your own server, check the grant at the token endpoint:
def token_endpoint(client, grant_type):
if grant_type not in client.allowed_grants:
return error("unauthorized_client")
if grant_type in ("password", "implicit"):
return error("unsupported_grant_type")
Remove password and implicit from your server's global defaults, not just from each client. Migrate old clients to the authorization code grant with PKCE.
How to test it
For each registered client, send a token request with every grant type you support and confirm only the expected ones succeed. Try grant_type=password against every client and expect failure. Request response_type=token at the authorization endpoint and expect an error. Export your client list and review it for implicitFlowEnabled or password grants set to true.
Common mistakes
- Leaving legacy grants on globally because one forgotten client uses them.
- Enabling client credentials on user facing clients.
- Testing only the default client and not every registered one.
Quick check
Which two grants must no longer be used?
The implicit grant and the resource owner password credentials grant.
