3.13 Verify that all code implementing or using Moved 2.0 Moved to V13 - Malicious session management controls is not affected code by any malicious code 3.14 Verify that authenticated session tokens Updated 3.0 Moved into 3.13 using cookies are protected by the use of "HttpOnly". 3.15 Verify that authenticated session tokens Updated 3.0 into 3.13 using cookies are protected with the "secure" attribute. 4.2 Verify that users can only access secured Updated 3.0 Rolled into 4.1 URLs for which they possess specific authorization. 4.3 Verify that users can only access secured Updated 3.0 Rolled into 4.1 data files for which they possess specific authorization. 4.13 Verify that limitations on input and access Moved 3.0 Moved to V15 Business Logic imposed by the business on the application (such as daily transaction limits or sequencing of tasks) cannot be bypassed. 4.15 Verify that all code implementing or using Moved 2.0 Moved to V13 Malicious access controls is not affected by any Controls malicious code. 5.2 Verify that a positive validation pattern is Deprecated 2.0 Removed as too difficult to defined and applied to all input implement particularly for free form text inputs 5.4 Verify that a character set, such as UTF-8, is Deprecated 3.0 Removed as too difficult to specified for all sources of input implement in most languages 5.7 Verify that all input validation failures are Deprecated 3.0 Removed as would create logged. too many useless logs that would be ignored 5.8 Verify that all input data is canonicalized for Deprecated 3.0 Removed as Type 1 JSP all downstream decoders or interpreters technology specific and not prior to validation.
3.13 Verify that all code implementing or using session management controls is not affected by any malicious code Moved 2.0 Moved to V13 - Malicious code 3.14 Verify that authenticated session tokens using cookies are protected by the use of "HttpOnly". Updated 3.0 Moved into 3.13 3.15 Verify that authenticated session tokens using cookies are protected with the "secure" attribute. Updated 3.0 into 3.13 4.2 Verify that users can only access secured URLs for which they possess specific authorization. Updated 3.0 Rolled into 4.1 4.3 Verify that users can only access secured data files for which they possess specific authorization. Updated 3.0 Rolled into 4.1 4.13 Verify that limitations on input and access imposed by the business on the application (such as daily transaction limits or sequencing of tasks) cannot be bypassed. Moved 3.0 Moved to V15 Business Logic 4.15 Verify that all code implementing or using access controls is not affected by any malicious code. Moved 2.0 Moved to V13 Malicious Controls 5.2 Verify that a positive validation pattern is defined and applied to all input Deprecated 2.0 Removed as too difficult to implement particularly for free form text inputs 5.4 Verify that a character set, such as UTF-8, is specified for all sources of input Deprecated 3.0 Removed as too difficult to implement in most languages 5.7 Verify that all input validation failures are logged. Deprecated 3.0 Removed as would create too many useless logs that would be ignored 5.8 Verify that all input data is canonicalized for all downstream decoders or interpreters prior to validation. Deprecated 3.0 Removed as Type 1 JSP technology specific and not
OWASP_Application_Security_Verification_Standard_3.0.1.docx