ASVS 5.0 V13.2.6 requires that when the application connects to separate services, it follows the documented configuration for each connection: maximum parallel connections, behavior at the limit, timeouts and retry strategy. It is Level 3.
Documentation from V13.1.2 and V13.1.3 only counts if the running code does what it says.
Why it matters
Drift is normal. A developer raises a pool size during an incident and forgets to revert it, or a new client library ships with its own default retries. The document then describes a system that no longer exists, and your denial of service protection is fiction.
How to implement it
Keep the numbers in one configuration source and have both the docs and the code read from it.
# config/connections.yaml
orders-db:
max_connections: 20
acquire_timeout_ms: 2000
inventory-api:
connect_timeout_ms: 500
total_timeout_ms: 2000
max_retries: 1
import yaml
cfg = yaml.safe_load(open("config/connections.yaml"))
pool = create_pool(max_size=cfg["orders-db"]["max_connections"],
acquire_timeout=cfg["orders-db"]["acquire_timeout_ms"] / 1000)
Add a startup log line that prints the effective values and a unit test that compares them to the file.
How to test it
Read the effective settings from the running service (startup log, metrics or a debug endpoint restricted to admins) and compare them with the documented values. Then fault inject: slow the dependency and verify the timeout and retry count in traces.
Common mistakes
- Different values per environment with no record.
- Library defaults silently overriding your setting.
- Hard coded numbers scattered across the codebase.
Quick check
How can you catch drift between docs and code?
Drive both from one config file and add a test or startup check that prints and verifies the effective values.
