OWASP Secure Coding Cheat Sheets: IndexASVS

# ASVS Index

## Table of Contents

- [Objective](#objective)
- [V1: Encoding and Sanitization](#v1-encoding-and-sanitization)
    - [V1.1 Encoding and Sanitization Architecture](#v11-encoding-and-sanitization-architecture)
    - [V1.2 Injection Prevention](#v12-injection-prevention)
    - [V1.3 Sanitization](#v13-sanitization)
    - [V1.4 Memory, String, and Unmanaged Code](#v14-memory-string-and-unmanaged-code)
    - [V1.5 Safe Deserialization](#v15-safe-deserialization)
- [V2: Validation and Business Logic](#v2-validation-and-business-logic)
    - [V2.1 Validation and Business Logic Documentation](#v21-validation-and-business-logic-documentation)
    - [V2.2 Input Validation](#v22-input-validation)
    - [V2.3 Business Logic Security](#v23-business-logic-security)
    - [V2.4 Anti-automation](#v24-anti-automation)
- [V3: Web Frontend Security](#v3-web-frontend-security)
    - [V3.1 Web Frontend Security Documentation](#v31-web-frontend-security-documentation)
    - [V3.2 Unintended Content Interpretation](#v32-unintended-content-interpretation)
    - [V3.3 Cookie Setup](#v33-cookie-setup)
    - [V3.4 Browser Security Mechanism Headers](#v34-browser-security-mechanism-headers)
    - [V3.5 Browser Origin Separation](#v35-browser-origin-separation)
    - [V3.6 External Resource Integrity](#v36-external-resource-integrity)
    - [V3.7 Other Browser Security Considerations](#v37-other-browser-security-considerations)
- [V4: API and Web Service](#v4-api-and-web-service)
    - [V4.1 Generic Web Service Security](#v41-generic-web-service-security)
    - [V4.2 HTTP Message Structure Validation](#v42-http-message-structure-validation)
    - [V4.3 GraphQL](#v43-graphql)
    - [V4.4 WebSocket](#v44-websocket)
- [V5: File Handling](#v5-file-handling)
    - [V5.1 File Handling Documentation](#v51-file-handling-documentation)
    - [V5.2 File Upload and Content](#v52-file-upload-and-content)
    - [V5.3 File Storage](#v53-file-storage)
    - [V5.4 File Download](#v54-file-download)
- [V6: Authentication](#v6-authentication)
    - [V6.1 Authentication Documentation](#v61-authentication-documentation)
    - [V6.2 Password Security](#v62-password-security)
    - [V6.3 General Authentication Security](#v63-general-authentication-security)
    - [V6.4 Authentication Factor Lifecycle and Recovery](#v64-authentication-factor-lifecycle-and-recovery)
    - [V6.5 General Multi-factor authentication requirements](#v65-general-multi-factor-authentication-requirements)
    - [V6.6 Out-of-Band authentication mechanisms](#v66-out-of-band-authentication-mechanisms)
    - [V6.7 Cryptographic authentication mechanism](#v67-cryptographic-authentication-mechanism)
    - [V6.8 Authentication with an Identity Provider](#v68-authentication-with-an-identity-provider)
- [V7: Session Management](#v7-session-management)
    - [V7.1 Session Management Documentation](#v71-session-management-documentation)
    - [V7.2 Fundamental Session Management Security](#v72-fundamental-session-management-security)
    - [V7.3 Session Timeout](#v73-session-timeout)
    - [V7.4 Session Termination](#v74-session-termination)
    - [V7.5 Defenses Against Session Abuse](#v75-defenses-against-session-abuse)
    - [V7.6 Federated Re-authentication](#v76-federated-re-authentication)
- [V8: Authorization](#v8-authorization)
    - [V8.1 Authorization Documentation](#v81-authorization-documentation)
    - [V8.2 General Authorization Design](#v82-general-authorization-design)
    - [V8.3 Operation Level Authorization](#v83-operation-level-authorization)
    - [V8.4 Other Authorization Considerations](#v84-other-authorization-considerations)
- [V9: Self-contained Tokens](#v9-self-contained-tokens)
    - [V9.1 Token source and integrity](#v91-token-source-and-integrity)
    - [V9.2 Token content](#v92-token-content)
- [V10: OAuth and OIDC](#v10-oauth-and-oidc)
    - [V10.1 Generic OAuth and OIDC Security](#v101-generic-oauth-and-oidc-security)
    - [V10.2 OAuth Client](#v102-oauth-client)
    - [V10.3 OAuth Resource Server](#v103-oauth-resource-server)
    - [V10.4 OAuth Authorization Server](#v104-oauth-authorization-server)
    - [V10.5 OIDC Client](#v105-oidc-client)
    - [V10.6 OpenID Provider](#v106-openid-provider)
    - [V10.7 Consent Management](#v107-consent-management)
- [V11: Cryptography](#v11-cryptography)
    - [V11.1 Cryptographic Inventory and Documentation](#v111-cryptographic-inventory-and-documentation)
    - [V11.2 Secure Cryptography Implementation](#v112-secure-cryptography-implementation)
    - [V11.3 Encryption Algorithms](#v113-encryption-algorithms)
    - [V11.4 Hashing and Hash-based Functions](#v114-hashing-and-hash-based-functions)
    - [V11.5 Random Values](#v115-random-values)
    - [V11.6 Public Key Cryptography](#v116-public-key-cryptography)
    - [V11.7 In-Use Data Cryptography](#v117-in-use-data-cryptography)
- [V12: Secure Communication](#v12-secure-communication)
    - [V12.1 General TLS Security Guidance](#v121-general-tls-security-guidance)
    - [V12.2 HTTPS Communication with External Facing Services](#v122-https-communication-with-external-facing-services)
    - [V12.3 General Service to Service Communication Security](#v123-general-service-to-service-communication-security)
- [V13: Configuration](#v13-configuration)
    - [V13.1 Configuration Documentation](#v131-configuration-documentation)
    - [V13.2 Backend Communication Configuration](#v132-backend-communication-configuration)
    - [V13.3 Secret Management](#v133-secret-management)
    - [V13.4 Unintended Information Leakage](#v134-unintended-information-leakage)
- [V14: Data Protection](#v14-data-protection)
    - [V14.1 Data Protection Documentation](#v141-data-protection-documentation)
    - [V14.2 General Data Protection](#v142-general-data-protection)
    - [V14.3 Client-side Data Protection](#v143-client-side-data-protection)
- [V15: Secure Coding and Architecture](#v15-secure-coding-and-architecture)
    - [V15.1: Secure Coding and Architecture Documentation](#v151-secure-coding-and-architecture-documentation)
    - [V15.2: Security Architecture and Dependencies](#v152-security-architecture-and-dependencies)
    - [V15.3: Defensive Coding](#v153-defensive-coding)
    - [V15.4: Safe Concurrency](#v154-safe-concurrency)
- [V16: Security Logging and Error Handling](#v16-security-logging-and-error-handling)
    - [V16.1: Security Logging Documentation](#v161-security-logging-documentation)
    - [V16.2: General Logging](#v162-general-logging)
    - [V16.3: Security Events](#v163-security-events)
    - [V16.4: Log Protection](#v164-log-protection)
    - [V16.5: Error Handling](#v165-error-handling)
- [V17: WebRTC](#v17-webrtc)
    - [V17.1: TURN Server](#v171-turn-server)
    - [V17.2: Media](#v172-media)
    - [V17.3: Signaling](#v173-signaling)

## Objective

The objective of this index is to help an OWASP [Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/) (A