HUMAN VERIFICATION REQUIRED ASVS 10.1.1 Token minimization (when oauth_oidc is used)

Tokens are only sent to components that strictly need them. For example, when using a backend-for-frontend pattern for browser-based JavaScript applications, access and refresh tokens shall only be accessible for the backend.