ASVS 5.0 V8.3.2 says that changes to the values authorization decisions depend on must be applied immediately. Where that is impossible, as with data baked into self-contained tokens, you need mitigating controls that alert when someone acts after losing rights and that revert the change. It is a Level 3 requirement. The standard notes that the alert-and-revert fallback does not prevent information leakage.
Why it matters
Fire an administrator at 10:00 and their JWT, valid until 11:00, still says role: admin. For an hour they can export data, create accounts or change settings. The longer the token lifetime, the larger that window.
How to implement it
Prefer a design where the decision reads current data.
- Keep tokens short lived, a few minutes, and carry only identity. Look up roles and entitlements on each request from a store you control, with a very short cache.
- Keep a revocation signal. When roles change or a user is disabled, write a
permissions_versioncounter or a revocation entry, and check it on each request.
def authorize(token_claims, required_perm):
user = users.get(token_claims["sub"]) # current record
if user is None or user.disabled:
raise Forbidden()
if token_claims.get("pv", 0) < user.permissions_version:
raise Forbidden("stale permissions, re-authenticate")
return required_perm in user.permissions
If you must trust token contents for some time, add the fallback: record every sensitive action with the token's issue time, compare against the permission change log, alert on any action taken after a revoking change, and reverse it.
How to test it
Log in, then remove a role or disable the account from the admin side. Without logging out, repeat a privileged request using the existing token. Expect denial within your documented time bound. Measure that bound and write it down.
Common mistakes
- Long lived tokens with roles inside and no revocation path.
- Caching permissions for hours.
- Updating the database but not the session store.
- Having no alert when a disabled user's token is still used.
Quick check
What if tokens must be self-contained?
Keep them short, and add alerting and reversal for actions taken after rights were removed.
