ASVS 5.0 V13.1.3: Document Timeouts, Retries and Resource Release

ASVS 5.0 V13.1.3 requires documentation of the resource management strategy for every external system: how handles, threads and connections are released, what timeouts apply, how failures are handled, and where retries happen with their limits, delays and back off. For synchronous request and response HTTP it calls for short timeouts and either no retries or tightly limited ones. This is Level 3.

Why it matters

Retries multiply load exactly when a dependency is struggling. Three layers each retrying three times turn one failed call into twenty seven. Missing timeouts make a slow dependency look like a hang that eats every worker thread.

How to implement it

Decide the policy once per dependency, document it and implement it in one place. Retry at a single layer.

- dependency: inventory-api
  call_type: synchronous http
  timeout: connect 500ms, total 2s
  retries: 1, only for idempotent GET, 100ms delay with jitter
  on_failure: return cached value or 503
  release: client closes body in finally block

Python with requests and an explicit timeout:

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

s = requests.Session()
retry = Retry(total=1, backoff_factor=0.1, status_forcelist=[502, 503],
              allowed_methods=["GET"])
s.mount("https://", HTTPAdapter(max_retries=retry))
r = s.get("https://inventory.internal/items/42", timeout=(0.5, 2))

Never retry non idempotent writes without an idempotency key.

How to test it

Inject faults: add latency or errors with a proxy such as toxiproxy, then confirm timeouts fire at the documented values, retries stop at the documented count and resources are freed (check open file descriptors and thread counts).

Common mistakes

• No timeout, which means the library default, often unlimited.
• Retries at the client, the SDK and the gateway at once.
• Retrying without jitter, so every client retries at the same moment.

Quick check

Sources

• OWASP ASVS