Questions tagged [asvs]

Application Security Verification Standard (ASVS) is an OWASP project to provide guidance to security control developers and a basis for specifying security requirements.

Filter by
Sorted by
Tagged with
0
votes
0answers
69 views

Has any 3rd party audited Keycloak for OWASP ASVS compliance (at any level - 1 2 or 3)?

Has any 3rd party audited Keycloak for OWASP ASVS compliance (at any level - 1 2 or 3)? I'm building a case for retiring the custom auth part of a legacy application in favour of Keycloak. The ...
0
votes
1answer
99 views

What parameters can be used to configure context-sensitive authorisation?

I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context. I don't consider ...
0
votes
2answers
152 views

How should I interpret, "access controls on the presentation layer are enforced on the server side?

This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9) I'm trying to deeply understand what it ...
0
votes
1answer
995 views

What is an “appropriate” request size limit for a web service?

Point 18.4 of the OWASP ASVS says Verify that all input is limited to an appropriate size limit. Currently i have an input limit of 50MB on all web services. (And it seems like this is the ...
0
votes
0answers
54 views

Recognized complement to OWASP's ASVS requirements

The OWASP ASVS focuses on web-application verification. It is free and recognised worldwide as a good reference to build upon, or simply reuse. It is useful to use it when outsourcing web development. ...
1
vote
2answers
151 views

OWASP ASVS asking for client-side validation?

While perusing ASVS 3.0.1 I came across requirement V5.18: Verify that client side validation is used as a second line of defense, in addition to server side validation. Umm... is client-side ...
4
votes
1answer
388 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
3
votes
2answers
862 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g., ...