The OWASP Application Security Verification Standard lists what a secure web application must do. This index links a guide for each ASVS 5.0 requirement, with how to implement it, how to test it and the mistakes to avoid.
Key takeaways
- 345 guides, one for each entry in the source.
- Each guide states the ASVS level (1, 2 or 3) the requirement belongs to.
- For a quick look at your own dependencies, use the free scan at gold.safeguard.sh/scan.
All guides
- ASVS 5.0 V1.1.1: Decode Input Once Before Validation
- ASVS 5.0 V1.1.2: Encode Output as the Last Step
- ASVS 5.0 V1.2.1: Encode Output for Its Context
- ASVS 5.0 V1.2.10: Defend Against CSV Formula Injection
- ASVS 5.0 V1.2.2: Build URLs Safely and Block Bad Schemes
- ASVS 5.0 V1.2.3: Prevent JavaScript and JSON Injection
- ASVS 5.0 V1.2.4: Use Parameterized Queries Everywhere
- ASVS 5.0 V1.2.5: Stop OS Command Injection
- ASVS 5.0 V1.2.6: Prevent LDAP Injection
- ASVS 5.0 V1.2.7: Parameterize XPath Queries
- ASVS 5.0 V1.2.8: Lock Down LaTeX Processors
- ASVS 5.0 V1.2.9: Escape Special Characters in Regex
- ASVS 5.0 V1.3.1: Sanitize WYSIWYG HTML With a Library
- ASVS 5.0 V1.3.10: Keep User Input Out of Format Strings
- ASVS 5.0 V1.3.11: Prevent SMTP and IMAP Injection
- ASVS 5.0 V1.3.12: Prevent Regular Expression DoS
- ASVS 5.0 V1.3.2: Avoid eval and Dynamic Code Execution
- ASVS 5.0 V1.3.3: Sanitize Data Before Dangerous Contexts
- ASVS 5.0 V1.3.4: Sanitize User Supplied SVG Files
- ASVS 5.0 V1.3.5: Sanitize Markdown, CSS and Template Content
- ASVS 5.0 V1.3.6: Block SSRF With Strict Allowlists
- ASVS 5.0 V1.3.7: Never Build Templates From User Input
- ASVS 5.0 V1.3.8: Prevent JNDI Injection in Java
- ASVS 5.0 V1.3.9: Sanitize Content Sent to Memcache
- ASVS 5.0 V1.4.1: Use Memory Safe Strings and Copies
- ASVS 5.0 V1.4.2: Prevent Integer Overflows With Range Checks
- ASVS 5.0 V1.4.3: Release Memory and Clear Dangling Pointers
- ASVS 5.0 V1.5.1: Configure XML Parsers to Block XXE
- ASVS 5.0 V1.5.2: Deserialize Untrusted Data Safely
- ASVS 5.0 V1.5.3: Keep Parsers Consistent for the Same Data
- ASVS 5.0 V10.1.1: Send Tokens Only to Components That Need Them
- ASVS 5.0 V10.1.2: Bind the OAuth Flow to the Starting Session
- ASVS 5.0 V10.2.1: Protect the OAuth Code Flow from CSRF
- ASVS 5.0 V10.2.2: Defend Against OAuth Mix-Up Attacks
- ASVS 5.0 V10.2.3: Request Only the OAuth Scopes You Need
- ASVS 5.0 V10.3.1: Resource Servers Must Check Token Audience
- ASVS 5.0 V10.3.2: Base Decisions on Scope, Sub and Authorization Details
- ASVS 5.0 V10.3.3: Identify Users by iss and sub, Not by Email
- ASVS 5.0 V10.3.4: Verify Authentication Strength and Recency
- ASVS 5.0 V10.3.5: Sender-Constrained Access Tokens (DPoP, mTLS)
- ASVS 5.0 V10.4.1: Exact Match Redirect URIs in OAuth
- ASVS 5.0 V10.4.10: Authenticate Confidential Clients on Back Channels
- ASVS 5.0 V10.4.11: Assign Only the Scopes a Client Needs
- ASVS 5.0 V10.4.12: Restrict response_mode to What Each Client Needs
- ASVS 5.0 V10.4.13: Always Pair the Code Grant with PAR
- ASVS 5.0 V10.4.14: Issue Only Sender-Constrained Access Tokens
- ASVS 5.0 V10.4.15: Protect authorization_details from User Tampering
- ASVS 5.0 V10.4.16: Use private_key_jwt or mTLS for Client Auth
- ASVS 5.0 V10.4.2: Authorization Codes Must Work Only Once
- ASVS 5.0 V10.4.3: Keep Authorization Codes Short-Lived
- ASVS 5.0 V10.4.4: Allow Only the Grants Each Client Needs
- ASVS 5.0 V10.4.5: Stop Refresh Token Replay for Public Clients
- ASVS 5.0 V10.4.6: Require PKCE and Reject the Plain Method
- ASVS 5.0 V10.4.7: Harden Unauthenticated Dynamic Client Registration
- ASVS 5.0 V10.4.8: Give Refresh Tokens an Absolute Expiry
- ASVS 5.0 V10.4.9: Let Users Revoke Tokens in the Auth Server UI
- ASVS 5.0 V10.5.1: Validate the Nonce in Every ID Token
- ASVS 5.0 V10.5.2: Identify Users by the sub Claim, Not Email
- ASVS 5.0 V10.5.3: Reject Metadata When the Issuer Does Not Match
- ASVS 5.0 V10.5.4: Check That the ID Token Audience Is Your client_id
- ASVS 5.0 V10.5.5: Validate OIDC Back-Channel Logout Tokens Strictly
- ASVS 5.0 V10.6.1: Limit OpenID Provider Response Types
- ASVS 5.0 V10.6.2: Stop Forced Logout Attacks at the OpenID Provider
- ASVS 5.0 V10.7.1: Get User Consent for Each Authorization Request
- ASVS 5.0 V10.7.2: Make the Consent Screen Clear and Specific
- ASVS 5.0 V10.7.3: Let Users Review, Change and Revoke Consents
- ASVS 5.0 V11.1.1: Write a Key Management Policy
- ASVS 5.0 V11.1.2: Build a Cryptographic Inventory
- ASVS 5.0 V11.1.3: Discover Every Use of Cryptography
- ASVS 5.0 V11.1.4: Plan Your Crypto Migration Path
- ASVS 5.0 V11.2.1: Use Validated Crypto Libraries Only
- ASVS 5.0 V11.2.2: Design for Crypto Agility
- ASVS 5.0 V11.2.3: Keep 128 Bits of Security Minimum
- ASVS 5.0 V11.2.4: Make Crypto Comparisons Constant Time
- ASVS 5.0 V11.2.5: Make Crypto Modules Fail Securely
- ASVS 5.0 V11.3.1: Ban ECB and PKCS#1 v1.5 Padding
- ASVS 5.0 V11.3.2: Use Only Approved Ciphers and Modes
- ASVS 5.0 V11.3.3: Authenticate Your Encrypted Data
- ASVS 5.0 V11.3.4: Never Reuse a Nonce or IV
- ASVS 5.0 V11.3.5: Use Encrypt Then MAC Order
- ASVS 5.0 V11.4.1: Stop Using MD5 for Crypto
- ASVS 5.0 V11.4.2: Store Passwords With Argon2id or Similar
- ASVS 5.0 V11.4.3: Pick Hashes With Enough Output Bits
- ASVS 5.0 V11.4.4: Derive Keys From Passwords With a KDF
- ASVS 5.0 V11.5.1: Generate Secrets With a CSPRNG
- ASVS 5.0 V11.5.2: Keep Random Number Generation Safe Under Load
- ASVS 5.0 V11.6.1: Generate Public Keys the Approved Way
- ASVS 5.0 V11.6.2: Use Safe Key Exchange Parameters
- ASVS 5.0 V11.7.1: Protect Data in Use With Memory Encryption
- ASVS 5.0 V11.7.2: Minimise Data Exposure During Processing
- ASVS 5.0 V12.1.1: Enable Only TLS 1.2 and TLS 1.3
- ASVS 5.0 V12.1.2: Enable Only Strong TLS Cipher Suites
- ASVS 5.0 V12.1.3: Validate mTLS Client Certificates Before Trust
- ASVS 5.0 V12.1.4: Turn On OCSP Stapling for Revocation
- ASVS 5.0 V12.1.5: Enable Encrypted Client Hello (ECH)
- ASVS 5.0 V12.2.1: Use TLS for Every External HTTP Connection
- ASVS 5.0 V12.2.2: Use Publicly Trusted TLS Certificates
- ASVS 5.0 V12.3.1: Encrypt Every Inbound and Outbound Connection
- ASVS 5.0 V12.3.2: TLS Clients Must Validate Server Certificates
- ASVS 5.0 V12.3.3: Encrypt Traffic Between Internal HTTP Services
- ASVS 5.0 V12.3.4: Trust Only Specific Internal CAs and Certs
- ASVS 5.0 V12.3.5: Strong Authentication Between Internal Services
- ASVS 5.0 V13.1.1: Document Every Outbound Communication Need
- ASVS 5.0 V13.1.2: Document Connection Limits and Limit Behavior
- ASVS 5.0 V13.1.3: Document Timeouts, Retries and Resource Release
- ASVS 5.0 V13.1.4: Document Critical Secrets and Rotation Schedules
- ASVS 5.0 V13.2.1: Authenticate Backend Components Without Static Keys
- ASVS 5.0 V13.2.2: Give Backend Accounts Only the Privileges They Need
- ASVS 5.0 V13.2.3: Never Use Default Credentials Between Services
- ASVS 5.0 V13.2.4: Allowlist Where Your Application Can Connect
- ASVS 5.0 V13.2.5: Configure the Server With an Outbound Allowlist
- ASVS 5.0 V13.2.6: Match Connection Behavior to Your Documentation
- ASVS 5.0 V13.3.1: Keep Backend Secrets in a Secrets Manager
- ASVS 5.0 V13.3.2: Apply Least Privilege to Secret Access
- ASVS 5.0 V13.3.3: Run Crypto Operations Inside an Isolated Module
- ASVS 5.0 V13.3.4: Expire and Rotate Secrets on a Schedule
- ASVS 5.0 V13.4.1: Keep .git and .svn Out of Production
- ASVS 5.0 V13.4.2: Turn Debug Modes Off in Production
- ASVS 5.0 V13.4.3: Do Not Expose Directory Listings
- ASVS 5.0 V13.4.4: Disable the HTTP TRACE Method
- ASVS 5.0 V13.4.5: Hide API Docs and Monitoring Endpoints
- ASVS 5.0 V13.4.6: Do Not Reveal Backend Versions
- ASVS 5.0 V13.4.7: Serve Only Allowed File Extensions
- ASVS 5.0 V14.1.1: Identify and Classify Sensitive Data
- ASVS 5.0 V14.1.2: Document Protection Requirements
- ASVS 5.0 V14.2.1: No Sensitive Data in URLs or Queries
- ASVS 5.0 V14.2.2: Keep Sensitive Data Out of Shared Caches
- ASVS 5.0 V14.2.3: Keep Sensitive Data From Trackers
- ASVS 5.0 V14.2.4: Implement the Documented Data Protections
- ASVS 5.0 V14.2.5: Prevent Web Cache Deception
- ASVS 5.0 V14.2.6: Return Only the Sensitive Data Needed
- ASVS 5.0 V14.2.7: Delete Sensitive Data on a Schedule
- ASVS 5.0 V14.2.8: Strip Metadata From User Uploads
- ASVS 5.0 V14.3.1: Clear Client Data When a Session Ends
- ASVS 5.0 V14.3.2: Set Anti Caching Headers on Sensitive Pages
- ASVS 5.0 V14.3.3: Keep Sensitive Data Out of Browser Storage
- ASVS 5.0 V15.1.1: Set Risk Based Patch Time Frames
- ASVS 5.0 V15.1.2: Maintain an SBOM and Trusted Sources
- ASVS 5.0 V15.1.3: Document Resource Heavy Functionality
- ASVS 5.0 V15.1.4: Flag Risky Third Party Components
- ASVS 5.0 V15.1.5: Document Dangerous Functionality in Code
- ASVS 5.0 V15.2.1: Keep Components Inside Fix Deadlines
- ASVS 5.0 V15.2.2: Defend Expensive Functions From Overload
- ASVS 5.0 V15.2.3: Ship Only What Production Needs
- ASVS 5.0 V15.2.4: Stop Dependency Confusion at the Registry
- ASVS 5.0 V15.2.5: Isolate Risky Components
- ASVS 5.0 V15.3.1: Return Only the Fields the Client Needs
- ASVS 5.0 V15.3.2: Do Not Follow Redirects in Server Calls
- ASVS 5.0 V15.3.3: Block Mass Assignment With Allowed Fields
- ASVS 5.0 V15.3.4: Get the Real Client IP Without Trusting Spoofs
- ASVS 5.0 V15.3.5: Check Types and Compare Strictly
- ASVS 5.0 V15.3.6: Prevent JavaScript Prototype Pollution
- ASVS 5.0 V15.3.7: Defend Against HTTP Parameter Pollution
- ASVS 5.0 V15.4.1: Protect Shared State From Race Conditions
- ASVS 5.0 V15.4.2: Make Check and Use One Atomic Step
- ASVS 5.0 V15.4.3: Keep Locks Consistent and Encapsulated
- ASVS 5.0 V15.4.4: Prevent Thread Starvation With Fair Pools
- ASVS 5.0 V16.1.1: Keep a Logging Inventory
- ASVS 5.0 V16.2.1: Put When, Where, Who and What in Every Log
- ASVS 5.0 V16.2.2: Synchronize Clocks and Log in UTC
- ASVS 5.0 V16.2.3: Log Only to Documented Destinations
- ASVS 5.0 V16.2.4: Use a Log Format Your Processor Can Read
- ASVS 5.0 V16.2.5: Keep Sensitive Data Out of Your Logs
- ASVS 5.0 V16.3.1: Log Every Authentication Attempt
- ASVS 5.0 V16.3.2: Log Failed Authorization Attempts
- ASVS 5.0 V16.3.3: Log Attempts to Bypass Security Controls
- ASVS 5.0 V16.3.4: Log Unexpected Errors and Control Failures
- ASVS 5.0 V16.4.1: Encode Log Data to Prevent Log Injection
- ASVS 5.0 V16.4.2: Protect Logs From Access and Modification
- ASVS 5.0 V16.4.3: Ship Logs to a Logically Separate System
- ASVS 5.0 V16.5.1: Return Generic Errors, Never Internal Detail
- ASVS 5.0 V16.5.2: Stay Secure When External Resources Fail
- ASVS 5.0 V16.5.3: Fail Securely and Never Fail Open
- ASVS 5.0 V16.5.4: Define a Last Resort Error Handler
- ASVS 5.0 V17.1.1: Block Reserved IP Ranges on Your TURN Server
- ASVS 5.0 V17.1.2: Keep Your TURN Server From Running Out of Ports
- ASVS 5.0 V17.2.1: Manage and Protect Your DTLS Certificate Key
- ASVS 5.0 V17.2.2: Use Approved DTLS Ciphers and SRTP Profiles
- ASVS 5.0 V17.2.3: Verify SRTP Authentication at the Media Server
- ASVS 5.0 V17.2.4: Keep Media Flowing Through Malformed SRTP Packets
- ASVS 5.0 V17.2.5: Keep Media Flowing During an SRTP Flood
- ASVS 5.0 V17.2.6: Check Your Media Server for the DTLS ClientHello Race
- ASVS 5.0 V17.2.7: Keep Call Recording Alive During an SRTP Flood
- ASVS 5.0 V17.2.8: Check the DTLS Certificate Against the SDP Fingerprint
- ASVS 5.0 V17.3.1: Rate Limit WebRTC Signaling Against Floods
- ASVS 5.0 V17.3.2: Make Signaling Survive Malformed Messages
- ASVS 5.0 V2.1.1: Document Your Input Validation Rules
- ASVS 5.0 V2.1.2: Document Rules for Combined Data Items
- ASVS 5.0 V2.1.3: Document Business Logic Limits
- ASVS 5.0 V2.2.1: Validate Input Against Allow Lists
- ASVS 5.0 V2.2.2: Enforce Input Validation Server Side
- ASVS 5.0 V2.2.3: Check That Related Data Items Make Sense
- ASVS 5.0 V2.3.1: Enforce Business Flow Step Order
- ASVS 5.0 V2.3.2: Implement the Documented Business Limits
- ASVS 5.0 V2.3.3: Use Transactions So Operations Fully Succeed or Roll Back
- ASVS 5.0 V2.3.4: Lock Limited Resources to Stop Double Booking
- ASVS 5.0 V2.3.5: Require Multi-User Approval for High Value Actions
- ASVS 5.0 V2.4.1: Add Anti-Automation Controls to Costly Functions
- ASVS 5.0 V2.4.2: Require Realistic Human Timing in Flows
- ASVS 5.0 V3.1.1: Document Required Browser Security Features
- ASVS 5.0 V3.2.1: Stop Browsers Rendering Content in the Wrong Context
- ASVS 5.0 V3.2.2: Render Text Safely With textContent
- ASVS 5.0 V3.2.3: Avoid DOM Clobbering in Client Side Code
- ASVS 5.0 V3.3.1: Set the Secure Attribute and Cookie Prefixes
- ASVS 5.0 V3.3.2: Choose SameSite by Cookie Purpose
- ASVS 5.0 V3.3.3: Use the __Host- Prefix for Cookie Names
- ASVS 5.0 V3.3.4: Set HttpOnly on Cookies Scripts Must Not Read
- ASVS 5.0 V3.3.5: Keep Cookie Name and Value Under 4096 Bytes
- ASVS 5.0 V3.4.1: Send HSTS With a One Year Max Age
- ASVS 5.0 V3.4.2: Validate CORS Origins Against an Allowlist
- ASVS 5.0 V3.4.3: Ship a Content Security Policy That Blocks Injection
- ASVS 5.0 V3.4.4: Send X-Content-Type-Options nosniff Everywhere
- ASVS 5.0 V3.4.5: Set a Referrer Policy That Stops URL Leaks
- ASVS 5.0 V3.4.6: Control Framing With CSP frame-ancestors
- ASVS 5.0 V3.4.7: Add a Violation Reporting Endpoint to Your CSP
- ASVS 5.0 V3.4.8: Set Cross-Origin-Opener-Policy on HTML Responses
- ASVS 5.0 V3.5.1: Block CSRF When You Do Not Rely on CORS Preflight
- ASVS 5.0 V3.5.2: Make Sure Sensitive Calls Always Trigger Preflight
- ASVS 5.0 V3.5.3: Use POST, PUT, PATCH or DELETE for Sensitive Actions
- ASVS 5.0 V3.5.4: Host Separate Applications on Separate Hostnames
- ASVS 5.0 V3.5.5: Validate Origin and Shape of postMessage Data
- ASVS 5.0 V3.5.6: Turn Off JSONP Everywhere
- ASVS 5.0 V3.5.7: Keep Authorized Data Out of Script Responses
- ASVS 5.0 V3.5.8: Stop Cross-Site Loading of Authenticated Resources
- ASVS 5.0 V3.6.1: Use Subresource Integrity for CDN Hosted Assets
- ASVS 5.0 V3.7.1: Drop Flash, Silverlight, Java Applets and Other Plugins
- ASVS 5.0 V3.7.2: Redirect Only to Allowlisted External Hosts
- ASVS 5.0 V3.7.3: Warn Users Before Sending Them Off Your Site
- ASVS 5.0 V3.7.4: Add Your Domain to the HSTS Preload List
- ASVS 5.0 V3.7.5: Define What Happens on Browsers Missing Security Features
- ASVS 5.0 V4.1.1: Send an Accurate Content-Type With a Charset
- ASVS 5.0 V4.1.2: Redirect HTTP to HTTPS for Browsers Only
- ASVS 5.0 V4.1.3: Stop Users Overriding Proxy Headers
- ASVS 5.0 V4.1.4: Allow Only the HTTP Methods You Use
- ASVS 5.0 V4.1.5: Sign Sensitive Messages Beyond TLS
- ASVS 5.0 V4.2.1: Prevent HTTP Request Smuggling
- ASVS 5.0 V4.2.2: Generate Correct Content-Length Headers
- ASVS 5.0 V4.2.3: No Connection Headers in HTTP/2 or HTTP/3
- ASVS 5.0 V4.2.4: Reject CR and LF in HTTP/2 and 3 Headers
- ASVS 5.0 V4.2.5: Keep Outbound URIs and Headers Short
- ASVS 5.0 V4.3.1: Limit GraphQL Query Depth and Cost
- ASVS 5.0 V4.3.2: Disable GraphQL Introspection in Production
- ASVS 5.0 V4.4.1: Use WSS for Every WebSocket
- ASVS 5.0 V4.4.2: Check Origin on the WebSocket Handshake
- ASVS 5.0 V4.4.3: Use Dedicated Tokens for WebSockets
- ASVS 5.0 V4.4.4: Issue WebSocket Tokens Over Logged In HTTPS
- ASVS 5.0 V5.1.1: Document Your File Upload Rules
- ASVS 5.0 V5.2.1: Cap Upload Size to Prevent Denial of Service
- ASVS 5.0 V5.2.2: Check File Extension and Real Content
- ASVS 5.0 V5.2.3: Check Archive Limits Before Unpacking
- ASVS 5.0 V5.2.4: Enforce Per-User File Quotas
- ASVS 5.0 V5.2.5: Block Symlinks in Uploaded Archives
- ASVS 5.0 V5.2.6: Reject Oversized Images to Stop Pixel Floods
- ASVS 5.0 V5.3.1: Never Execute Uploaded Files as Server Code
- ASVS 5.0 V5.3.2: Build File Paths From Trusted Data, Not Filenames
- ASVS 5.0 V5.3.3: Stop Zip Slip When Extracting Files
- ASVS 5.0 V5.4.1: Control Download Filenames
- ASVS 5.0 V5.4.2: Encode Served Filenames
- ASVS 5.0 V5.4.3: Scan Untrusted Files for Malware
- ASVS 5.0 V6.1.1: Document Credential Stuffing Defenses
- ASVS 5.0 V6.1.2: Document Context Specific Password Words
- ASVS 5.0 V6.1.3: Document Every Authentication Pathway
- ASVS 5.0 V6.2.1: Set a Real Minimum Password Length
- ASVS 5.0 V6.2.10: Do Not Force Periodic Password Rotation
- ASVS 5.0 V6.2.11: Enforce the Context Word List
- ASVS 5.0 V6.2.12: Check New Passwords Against Breaches
- ASVS 5.0 V6.2.2: Let Users Change Their Password
- ASVS 5.0 V6.2.3: Require Current Password to Change It
- ASVS 5.0 V6.2.4: Block the Top 3000 Passwords
- ASVS 5.0 V6.2.5: Drop Password Composition Rules
- ASVS 5.0 V6.2.6: Mask Password Fields
- ASVS 5.0 V6.2.7: Allow Paste and Password Managers
- ASVS 5.0 V6.2.8: Verify Passwords Exactly as Received
- ASVS 5.0 V6.2.9: Allow Passwords of 64 Characters or More
- ASVS 5.0 V6.3.1: Enforce Credential Stuffing Controls
- ASVS 5.0 V6.3.2: Remove or Disable Default Accounts
- ASVS 5.0 V6.3.3: Require Multiple Authentication Factors
- ASVS 5.0 V6.3.4: No Undocumented Authentication Paths
- ASVS 5.0 V6.3.5: Notify Users of Suspicious Sign Ins
- ASVS 5.0 V6.3.6: Do Not Use Email as an Auth Factor
- ASVS 5.0 V6.3.7: Notify Users When Credentials Change
- ASVS 5.0 V6.3.8: Do Not Reveal Which Users Exist
- ASVS 5.0 V6.4.1: Secure Initial Passwords and Activation Codes
- ASVS 5.0 V6.4.2: No Password Hints or Secret Questions
- ASVS 5.0 V6.4.3: Password Reset That Does Not Bypass MFA
- ASVS 5.0 V6.4.4: Identity Proofing When an MFA Factor Is Lost
- ASVS 5.0 V6.4.5: Remind Users Before Authenticators Expire
- ASVS 5.0 V6.4.6: Admins Start Resets, Never Choose Passwords
- ASVS 5.0 V6.5.1: Lookup Secrets, OOB Codes and TOTP Work Once
- ASVS 5.0 V6.5.2: Hash Lookup Secrets Stored on the Backend
- ASVS 5.0 V6.5.3: Generate MFA Secrets With a CSPRNG
- ASVS 5.0 V6.5.4: Minimum Entropy for Recovery and OOB Codes
- ASVS 5.0 V6.5.5: Lifetimes for OOB Codes, Tokens and TOTP
- ASVS 5.0 V6.5.6: Revoke Any Authentication Factor After Loss
- ASVS 5.0 V6.5.7: Biometrics Only as a Secondary Factor
- ASVS 5.0 V6.5.8: Check TOTP Against a Trusted Time Source
- ASVS 5.0 V6.6.1: Handle SMS and Phone OTP With Care
- ASVS 5.0 V6.6.2: Bind Out of Band Codes to the Original Request
- ASVS 5.0 V6.6.3: Rate Limit Code Guessing on OOB Authentication
- ASVS 5.0 V6.6.4: Stop Push Bombing on MFA Notifications
- ASVS 5.0 V6.7.1: Protect Certificates That Verify Assertions
- ASVS 5.0 V6.7.2: Challenge Nonces of 64 Bits and Unique
- ASVS 5.0 V6.8.1: Prevent Identity Spoofing Across Multiple IdPs
- ASVS 5.0 V6.8.2: Always Validate Signatures on Auth Assertions
- ASVS 5.0 V6.8.3: Process Each SAML Assertion Only Once
- ASVS 5.0 V6.8.4: Verify Authentication Strength From the IdP
- ASVS 5.0 V7.1.1: Document Session Timeouts and Lifetime
- ASVS 5.0 V7.1.2: Document Concurrent Session Limits
- ASVS 5.0 V7.1.3: Document Federated Session Systems
- ASVS 5.0 V7.2.1: Verify Session Tokens on a Trusted Backend
- ASVS 5.0 V7.2.2: Use Dynamic Session Tokens, Not Static Keys
- ASVS 5.0 V7.2.3: Reference Tokens Need 128 Bits of Entropy
- ASVS 5.0 V7.2.4: Issue a New Session Token on Every Login
- ASVS 5.0 V7.3.1: Enforce an Inactivity Timeout
- ASVS 5.0 V7.3.2: Set an Absolute Maximum Session Lifetime
- ASVS 5.0 V7.4.1: Make Logout Actually End the Session
- ASVS 5.0 V7.4.2: End All Sessions When an Account Is Disabled
- ASVS 5.0 V7.4.3: Offer to End Other Sessions After Credential Changes
- ASVS 5.0 V7.4.4: Easy and Visible Logout on Every Page
- ASVS 5.0 V7.4.5: Let Admins Terminate User Sessions
- ASVS 5.0 V7.5.1: Reauthenticate Before Changing Account Recovery Data
- ASVS 5.0 V7.5.2: Let Users View and End Active Sessions
- ASVS 5.0 V7.5.3: Step Up Authentication for Sensitive Operations
- ASVS 5.0 V7.6.1: Make RP and IdP Sessions Behave as Documented
- ASVS 5.0 V7.6.2: Require User Action to Create a Session
- ASVS 5.0 V8.1.1: Document Function and Data Access Rules
- ASVS 5.0 V8.1.2: Document Field Level Access Rules
- ASVS 5.0 V8.1.3: Document Contextual Security Attributes
- ASVS 5.0 V8.1.4: Document Contextual Access Decisions
- ASVS 5.0 V8.2.1: Restrict Function Level Access to Explicit Permissions
- ASVS 5.0 V8.2.2: Stop IDOR and BOLA With Per Object Checks
- ASVS 5.0 V8.2.3: Restrict Access to Individual Fields (BOPLA)
- ASVS 5.0 V8.2.4: Adaptive Controls Based on Context
- ASVS 5.0 V8.3.1: Enforce Authorization on a Trusted Layer
- ASVS 5.0 V8.3.2: Apply Permission Changes Immediately
- ASVS 5.0 V8.3.3: Authorize as the Originating User
- ASVS 5.0 V8.4.1: Cross-Tenant Controls in Multi-Tenant Apps
- ASVS 5.0 V8.4.2: Layered Security for Admin Interfaces
- ASVS 5.0 V9.1.1: Verify Token Signatures Before Trusting Them
- ASVS 5.0 V9.1.2: Allowlist Token Algorithms, Never Allow None
- ASVS 5.0 V9.1.3: Use Only Trusted Sources for Token Keys
- ASVS 5.0 V9.2.1: Enforce Token Validity Windows (nbf and exp)
- ASVS 5.0 V9.2.2: Accept Only the Right Type of Token
- ASVS 5.0 V9.2.3: Only Accept Tokens Meant for Your Service
- ASVS 5.0 V9.2.4: Audience Restrictions When Keys Are Shared
Frequently asked questions
Are these official documents?
No. They are explanatory guides written by Safeguard from the public source. Check the original for the authoritative text.
Who are they for?
Developers, security engineers and compliance leads who need to understand and show each item.
Last reviewed: 19 October 2026.
