V14.5.4 seems like it doesn't add much

[tghosth]

#	Description	L1	L2	L3	CWE
V14.5.4	Verify that HTTP headers added by a trusted proxy or SSO devices, such as a bearer token, are authenticated by the application.		✓	✓	306

Looks like this is basically a copy/paste of 11.3 from ASVS 2.0.

If I am honest, I am not sure what exactly this is for and if it really adds anything to existing requirements. I am open to suggestions but I am inclined to delete this :)

[elarlang]

If "authenticated by" means verify JWT token signature, then it's covered by current 3.5.3.

If it's not, then I'm not sure what it actually requires. One problem where I/we have used it for pen-test reports: when client sends some X-Whatever-Header and this header is used by the application as input from proxy, waf or other participant in HTTP communication. But from described situation perspective, I think we need actually separate requirement.

[tghosth]

I opened a PR to delete it.