OWASP ASVS 5.0 section 10.4.8 requires strict refresh token expiry, which conflicts with FAPI 2.0 SP 5.3.2.1-9

[sakimura]

It says

10.4.8 Verify that refresh tokens have an absolute expiration, including if sliding refresh token expiration is applied.

(Source) OWASP ASVS 5.0 https://github.com/OWASP/ASVS/tree/v5.0.0#latest-stable-version---500

This is contrary to FAPI 2.0 Security Profile 5.3.2.1-9 that states "shall not use refresh token rotation except in extraordinary circumstances"

[sakimura]

Discussed it on 2026-09-16 Atlantic meeting. See the meeting notes for details.

[sakimura]

Further discussed it on 2026-09-18 Pacific Call.

Agreed that it is not a security provision but a privacy measure linked to the grant length.