Certain implementations of the present disclosure relates to a method, device, and medium to perform association validation of a client device's request during an association validation phase based on a plurality of capabilities associated with the client device. The network device receives an association request to connect to a wireless network. Then, the network device extracts a parameter specific to the client device from the association request, and determines a plurality of capabilities associated with the client device based on a value of the parameter. Then, the network device transmits the plurality of capabilities to an authentication server during an association validation phase, and receives an association validation decision corresponding to the connection request from an association validation/authentication server. If the association validation decision indicates that the client device is denied access to the wireless network, the network device deauthenticates the client device during the association validation phase.