ASVS 5.0 V2.1.2 requires that your documentation says how to validate the logical and contextual consistency of data items taken together, such as checking that a suburb and a ZIP code match. It is a Level 2 requirement.
Why it matters
Every field can be valid alone while the combination is nonsense or hostile: a ship date before the order date, a refund larger than the original payment, a country code that does not fit the currency. Attackers look for these cross field gaps because single field validators never catch them.
How to implement it
List the relationships next to your field rules. Write each as a plain sentence a tester can act on.
- End date must be on or after start date.
- Refund amount must not exceed the original payment minus earlier refunds.
- Postal code must belong to the stated region, checked against a reference table.
- A user may only set a role that their own role is allowed to grant.
Then implement each in the service layer, not only the form.
How to test it
For every documented relationship, send a request where each field is individually valid but the pair breaks the rule. Confirm rejection and a clear error. Check also that updates to one field re-run the check against the stored value of the other.
Tip
Ask testers to read this section of the document before they write test cases. Each sentence becomes at least one negative test, and gaps they notice tend to be gaps in the rules, not only in the code.
Common mistakes
- Checking the pair on create but not on update.
- Leaving the rules in a ticket instead of the documentation.
Quick check
Where should cross field checks run?
On the server, after parsing, before the data is used. Client side checks only help usability.
