OWASP Cheat Sheet Series: IndexASVS4

# DEPRECATED: ASVS 4.0 Index

## Table of Contents

- [Objective](#objective)
- [V1: Architecture, Design and Threat Modeling Requirements](#v1-architecture-design-and-threat-modeling-requirements)
    - [V1.1 Secure Software Development Lifecycle Requirements](#v11-secure-software-development-lifecycle-requirements)
    - [V1.2 Authentication Architectural Requirements](#v12-authentication-architectural-requirements)
    - [V1.3 Session Management Architectural Requirements](#v13-session-management-architectural-requirements)
    - [V1.4 Access Control Architectural Requirements](#v14-access-control-architectural-requirements)
    - [V1.5 Input and Output Architectural Requirements](#v15-input-and-output-architectural-requirements)
    - [V1.6 Cryptographic Architectural Requirements](#v16-cryptographic-architectural-requirements)
    - [V1.7 Errors, Logging and Auditing Architectural Requirements](#v17-errors-logging-and-auditing-architectural-requirements)
    - [V1.8 Data Protection and Privacy Architectural Requirements](#v18-data-protection-and-privacy-architectural-requirements)
    - [V1.9 Communications Architectural Requirements](#v19-communications-architectural-requirements)
    - [V1.10 Malicious Software Architectural Requirements](#v110-malicious-software-architectural-requirements)
    - [V1.11 Business Logic Architectural Requirements](#v111-business-logic-architectural-requirements)
    - [V1.12 Secure File Upload Architectural Requirements](#v112-secure-file-upload-architectural-requirements)
    - [V1.13 API Architectural Requirements](#v113-api-architectural-requirements)
    - [V1.14 Configuration Architectural Requirements](#v114-configuration-architectural-requirements)
- [V2: Authentication Verification Requirements](#v2-authentication-verification-requirements)
    - [V2.1 Password Security Requirements](#v21-password-security-requirements)
    - [V2.2 General Authenticator Requirements](#v22-general-authenticator-requirements)
    - [V2.3 Authenticator Lifecycle Requirements](#v23-authenticator-lifecycle-requirements)
    - [V2.4 Credential Storage Requirements](#v24-credential-storage-requirements)
    - [V2.5 Credential Recovery Requirements](#v25-credential-recovery-requirements)
    - [V2.6 Look-up Secret Verifier Requirements](#v26-look-up-secret-verifier-requirements)
    - [V2.7 Out of Band Verifier Requirements](#v27-out-of-band-verifier-requirements)
    - [V2.8 Single or Multi Factor One Time Verifier Requirements](#v28-single-or-multi-factor-one-time-verifier-requirements)
    - [V2.9 Cryptographic Software and Devices Verifier Requirements](#v29-cryptographic-software-and-devices-verifier-requirements)
    - [V2.10 Service Authentication Requirements](#v210-service-authentication-requirements)
- [V3: Session Management Verification Requirements](#v3-session-management-verification-requirements)
    - [V3.1 Fundamental Session Management Requirements](#v31-fundamental-session-management-requirements)
    - [V3.2 Session Binding Requirements](#v32-session-binding-requirements)
    - [V3.3 Session Logout and Timeout Requirements](#v33-session-logout-and-timeout-requirements)
    - [V3.4 Cookie-based Session Management](#v34-cookie-based-session-management)
    - [V3.5 Token-based Session Management](#v35-token-based-session-management)
    - [V3.6 Re-authentication from a Federation or Assertion](#v36-re-authentication-from-a-federation-or-assertion)
    - [V3.7 Defenses Against Session Management Exploits](#v37-defenses-against-session-management-exploits)
- [V4: Access Control Verification Requirements](#v4-access-control-verification-requirements)
    - [V4.1 General Access Control Design](#v41-general-access-control-design)
    - [V4.2 Operation Level Access Control](#v42-operation-level-access-control)
    - [V4.3 Other Access Control Considerations](#v43-other-access-control-considerations)
- [V5: Validation, Sanitization and Encoding Verification Requirements](#v5-validation-sanitization-and-encoding-verification-requirements)
    - [V5.1 Input Validation Requirements](#v51-input-validation-requirements)
    - [V5.2 Sanitization and Sandboxing Requirements](#v52-sanitization-and-sandboxing-requirements)
    - [V5.3 Output encoding and Injection Prevention Requirements](#v53-output-encoding-and-injection-prevention-requirements)
    - [V5.4 Memory, String, and Unmanaged Code Requirements](#v54-memory-string-and-unmanaged-code-requirements)
    - [V5.5 Deserialization Prevention Requirements](#v55-deserialization-prevention-requirements)
- [V6: Stored Cryptography Verification Requirements](#v6-stored-cryptography-verification-requirements)
    - [V6.1 Data Classification](#v61-data-classification)
    - [V6.2 Algorithms](#v62-algorithms)
    - [V6.3 Random Values](#v63-random-values)
    - [V6.4 Secret Management](#v64-secret-management)
- [V7: Error Handling and Logging Verification Requirements](#v7-error-handling-and-logging-verification-requirements)
    - [V7.1 Log Content Requirements](#v71-log-content-requirements)
    - [V7.2 Log Processing Requirements](#v72-log-processing-requirements)
    - [V7.3 Log Protection Requirements](#v73-log-protection-requirements)
    - [V7.4 Error Handling](#v74-error-handling)
- [V8: Data Protection Verification Requirements](#v8-data-protection-verification-requirements)
    - [V8.1 General Data Protection](#v81-general-data-protection)
    - [V8.2 Client-side Data Protection](#v82-client-side-data-protection)
    - [V8.3 Sensitive Private Data](#v83-sensitive-private-data)
- [V9: Communications Verification Requirements](#v9-communications-verification-requirements)
    - [V9.1 Communications Security Requirements](#v91-communications-security-requirements)
    - [V9.2 Server Communications Security Requirements](#v92-server-communications-security-requirements)
- [V10: Malicious Code Verification Requirements](#v10-malicious-code-verification-requirements)
    - [V10.1 Code Integrity Controls](#v101-code-integrity-controls)
    - [V10.2 Malicious Code Search](#v102-malicious-code-search)
    - [V10.3 Deployed Application Integrity Controls](#v103-deployed-application-integrity-controls)
- [V11: Business Logic Verification Requirements](#v11-business-logic-verification-requirements)
    - [V11.1 Business Logic Security Requirements](#v111-business-logic-security-requirements)
- [V12: File and Resources Verification Requirements](#v12-file-and-resources-verification-requirements)
    - [V12.1 File Upload Requirements](#v121-file-upload-requirements)
    - [V12.2 File Integrity Requirements](#v122-file-integrity-requirements)
    - [V12.3 File execution Requirements](#v123-file-execution-requirements)
    - [V12.4 File Storage Requirements](#v124-file-storage-requirements)
    - [V12.5 File Download Requirements](#v125-file-download-requirements)
    - [V12.6 SSRF Protection Requirements](#v126-ssrf-protection-requirements)
- [V13: API and Web Service Verification Requirements](#v13-api