OWASP ASVS (Application Security Verification Standard)

• · AS2 — Security controls are centralized, not duplicated. Authentication, authorization, validation, and encoding logic live in shared, reusable components — not reimplemented per endpoint/feature.
• · AS3 — Trust boundaries are explicitly documented, especially at L2+ — where does data cross from less-trusted to more-trusted context, and what control sits at that exact boundary.
• · AS4 — Session management is server-authoritative. Session state, expiry, and invalidation are controlled server-side; client-supplied session claims are never trusted without server verification.
• · AS5 — Access control decisions cannot be bypassed by direct object/URL manipulation (ties to OWASP API A01), and are enforced on every layer a request could reach (API, direct DB access if applicable, admin tooling).
• · AS6 — All input is validated, canonicalized, and encoded for its output context — consistent with OWASP Top 10 A03, applied as a first-class architectural control, not per-field ad hoc.

• · The "one auth check to rule them all" test: grep for how many distinct places implement authentication/authorization logic — if it's more than one canonical middleware/guard, centralization (AS2) has already eroded.
• · The workflow-replay test: can a multi-step business flow (checkout, application submission, approval) be replayed out of order or repeated beyond its intended count by directly calling later-step endpoints? (AS9)
• · The trust-boundary walk: for L2+, walk the data flow diagram and mark every boundary crossing; if a boundary has no named control, that's a gap (AS3).

• · Ver anti-patrones específicos del dominio en el pack.

• [ ] Target ASVS level stated and documented. (AV1)
• [ ] Authentication/authorization centralized in one reusable mechanism. (AV2)
• [ ] Session tokens server-generated, server-expired, server-invalidated on logout/password change. (AV4)
• [ ] Authorization enforced at every layer capable of reaching the data (not API-only if direct DB access exists). (AV5)
• [ ] Input validation uses allowlisting where the valid space is enumerable. (AV6)
• [ ] Logs sufficient for incident reconstruction, no secrets/full PII. (AV8)

• OWASP Application Security Verification Standard (ASVS) 5.0.0

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• specOWASP Application Security Verification Standard (ASVS) 5.0.0OWASP Foundation. (5.0.0, May 2025, supersedes 4.0.3 and renumbers requirement IDs — this pack distils ASVS by concept and cites no specific requirement number, so it tracks the current version.)