ASVS 5.0 V10.7.2 (Level 2) requires that when the authorization server asks for consent, it gives sufficient and clear information. Where it applies, that means the nature of the requested access (scopes, resource server, or Rich Authorization Request details), the identity of the application, and how long the authorization lasts.
Why it matters
A prompt that says only "Allow access?" is not consent in any meaningful sense. Users approve what they can understand, and phishing relies on vague screens.
How to implement it
Map every scope to a plain sentence and show it, along with the app, the duration and the redirect host.
SCOPE_TEXT = {
"orders.read": "See your orders and their status",
"orders.write": "Create and cancel orders for you",
"offline_access": "Stay connected until you revoke access",
}
def consent_context(client, scopes, refresh_days):
return {
"app_name": client.display_name,
"verified": client.identity_assured,
"redirect_host": urlparse(client.primary_redirect_uri).hostname,
"permissions": [SCOPE_TEXT[s] for s in scopes],
"duration": f"Access lasts up to {refresh_days} days unless you revoke it",
}
Escape the app name when rendering, since it is client supplied. Fail closed on unknown scopes: refuse the request instead of showing a blank line.
How to test it
Review the consent screen for each client against the list: what, who, how long. Request a scope that has no description and confirm the request is refused. Register a client name with HTML and confirm it renders as text.
Language and accessibility
Write permission text at a plain reading level and keep it short. Put the most sensitive permissions first. Make sure the screen works with a screen reader and at narrow widths, because a prompt people cannot read is not informed consent either.
Common mistakes
- Showing raw scope strings.
- Hiding the lifetime.
- Display names that imitate trusted brands, with no unverified label.
Quick check
Which three things should a prompt convey?
What access is being granted, which application is asking, and how long the authorization lasts.
