Skip to content

# ASVS Index

## Table of Contents

- Objective
- V1: Encoding and Sanitization
  - V1.1 Encoding and Sanitization Architecture
  - V1.2 Injection Prevention
  - V1.3 Sanitization
  - V1.4 Memory, String, and Unmanaged Code
  - V1.5 Safe Deserialization
- V2: Validation and Business Logic
  - V2.1 Validation and Business Logic Documentation
  - V2.2 Input Validation
  - V2.3 Business Logic Security
  - V2.4 Anti-automation
- V3: Web Frontend Security
  - V3.1 Web Frontend Security Documentation
  - V3.2 Unintended Content Interpretation
  - V3.3 Cookie Setup
  - V3.4 Browser Security Mechanism Headers
  - V3.5 Browser Origin Separation
  - V3.6 External Resource Integrity
  - V3.7 Other Browser Security Considerations
- V4: API and Web Service
  - V4.1 Generic Web Service Security
  - V4.2 HTTP Message Structure Validation
  - V4.3 GraphQL
  - V4.4 WebSocket
- V5: File Handling
  - V5.1 File Handling Documentation
  - V5.2 File Upload and Content
  - V5.3 File Storage
  - V5.4 File Download
- V6: Authentication
  - V6.1 Authentication Documentation
  - V6.2 Password Security
  - V6.3 General Authentication Security
  - V6.4 Authentication Factor Lifecycle and Recovery
  - V6.5 General Multi-factor authentication requirements
  - V6.6 Out-of-Band authentication mechanisms
  - V6.7 Cryptographic authentication mechanism
  - V6.8 Authentication with an Identity Provider
- V7: Session Management
  - V7.1 Session Management Documentation
  - V7.2 Fundamental Session Management Security
  - V7.3 Session Timeout
  - V7.4 Session Termination
  - V7.5 Defenses Against Session Abuse
  - V7.6 Federated Re-authentication
- V8: Authorization
  - V8.1 Authorization Documentation
  - V8.2 General Authorization Design
  - V8.3 Operation Level Authorization
  - V8.4 Other Authorization Considerations
- V9: Self-contained Tokens
  - V9.1 Token source and integrity
  - V9.2 Token content
- V10: OAuth and OIDC
  - V10.1 Generic OAuth and OIDC Security
  - V10.2 OAuth Client
  - V10.3 OAuth Resource Server
  - V10.4 OAuth Authorization Server
  - V10.5 OIDC Client
  - V10.6 OpenID Provider
  - V10.7 Consent Management
- V11: Cryptography
  - V11.1 Cryptographic Inventory and Documentation
  - V11.2 Secure Cryptography Implementation
  - V11.3 Encryption Algorithms
  - V11.4 Hashing and Hash-based Functions
  - V11.5 Random Values
  - V11.6 Public Key Cryptography
  - V11.7 In-Use Data Cryptography
- V12: Secure Communication
  - V12.1 General TLS Security Guidance
  - V12.2 HTTPS Communication with External Facing Services
  - V12.3 General Service to Service Communication Security
- V13: Configuration
  - V13.1 Configuration Documentation
  - V13.2 Backend Communication Configuration
  - V13.3 Secret Management
  - V13.4 Unintended Information Leakage
- V14: Data Protection
  - V14.1 Data Protection Documentation
  - V14.2 General Data Protection
  - V14.3 Client-side Data Protection
- V15: Secure Coding and Architecture
  - V15.1: Secure Coding and Architecture Documentation
  - V15.2: Security Architecture and Dependencies
  - V15.3: Defensive Coding
  - V15.4: Safe Concurrency
- V16: Security Logging and Error Handling
  - V16.1: Security Logging Documentation
  - V16.2: General Logging
  - V16.3: Security Events
  - V16.4: Log Protection
  - V16.5: Error Handling
- V17: WebRTC
  - V17.1: TURN Server
  - V17.2: Media
  - V17.3: Signaling

## Objective

The objective of this index is to help an OWASP Application Security Verification Standard (ASVS) user clearly identify which cheat sheets are useful for each section during his or her usage of the ASVS.

This index is based on the version 5.0.x of the ASVS.

## V1: Encoding and Sanitization

### V1.1 Encoding and Sanitization Architecture

Cross Site Scripting Prevention Cheat Sheet

### V1.2 Injection Prevention

Bean Validation Cheat Sheet

Cross Site Scripting Prevention Cheat Sheet

DOM based XSS Prevention Cheat Sheet

File Upload Cheat Sheet

Injection Prevention Cheat Sheet

Input Validation Cheat Sheet

Java Security Cheat Sheet

LDAP Injection Prevention

OS Command Injection Defense

Query Parameterization Cheat Sheet

SQL Injection Prevention

XML Security Cheat Sheet

XSS Filter Evasion Cheat Sheet

XML External Entity Prevention Cheat Sheet

### V1.3 Sanitization

Cross-Site Request Forgery Prevention Cheat Sheet

Cross Site Scripting Prevention Cheat Sheet

DOM based XSS Prevention Cheat Sheet

Injection Prevention Cheat Sheet

Injection Prevention Cheat Sheet in Java

Input Validation Cheat Sheet

LDAP Injection Prevention

Server Side Request Forgery Prevention Cheat Sheet

XML External Entity Prevention Cheat Sheet

### V1.4 Memory, String, and Unmanaged Code

None.

### V1.5 Safe Deserialization

Deserialization Cheat Sheet

Server Side Request Forgery Prevention Cheat Sheet

XML Security Cheat Sheet

XML External Entity Prevention Cheat Sheet

## V2: Validation and Business Logic

### V2.1 Validation and Business Logic Documentation

Abuse Case Cheat Sheet

### V2.2 Input Validation

Input Validation Cheat Sheet

Microservices Security Cheat Sheet

Web Service Security Cheat Sheet

### V2.3 Business Logic Security

Abuse Case Cheat Sheet

### V2.4 Anti-automation

Denial of Service Cheat Sheet

## V3: Web Frontend Security

### V3.1 Web Frontend Security Documentation

Content Security Policy Cheat Sheet

Cross-Site Request Forgery Prevention Cheat Sheet

HTTP Strict Transport Security Cheat Sheet

### V3.2 Unintended Content Interpretation

Cross-Site Request Forgery Prevention Cheat Sheet

DOM Clobbering Prevention Cheat Sheet

HTML5 Security Cheat Sheet

Third Party Javascript Management Cheat Sheet

### V3.3 Cookie Setup

Cross-Site Request Forgery Prevention Cheat Sheet

Session Management Cheat Sheet

Transport Layer Security Cheat Sheet

### V3.4 Browser Security Mechanism Headers

Cross-Site Request Forgery Prevention Cheat Sheet

HTML5 Security Cheat Sheet

HTTP Strict Transport Security Cheat Sheet

### V3.5 Browser Origin Separation

Cross-Site Request Forgery Prevention Cheat Sheet

HTML5 Security Cheat Sheet

### V3.6 External Resource Integrity

Third Party Javascript Management Cheat Sheet

### V3.7 Other Browser Security Considerations

Cross-Site Request Forgery Prevention Cheat Sheet

HTTP Strict Transport Security Cheat Sheet

Third Party Javascript Management Cheat Sheet

Unvalidated Redirects and Forwards Cheat Sheet

## V4: API and Web Service

### V4.1 Generic Web Service Security

Cross-Site Request Forgery Prevention Cheat Sheet

REST Assessment Cheat Sheet

REST Security Cheat Sheet

Transport Layer Security Cheat Sheet

Web Service Security Cheat Sheet

### V4.2 HTTP Message Structure Validation

REST Security Cheat Sheet

Web Service Security Cheat Sheet

### V4.3 GraphQL

REST Security Cheat Sheet

### V4.4 WebSocket

REST Security Cheat Sheet

Transport Layer Security Cheat Sheet

## V5: File Handling

### V5.1 File Handling Documentation

Input Validation Cheat Sheet

File Upload Cheat Sheet

### V5.2 File Upload and Content

Input Validation Cheat Sheet

File Upload Cheat Sheet

### V5.3 File Storage

Input Validation Cheat Sheet

Server Side Request Forgery Prevention Cheat Sheet

### V5.4 File Download

File Upload Cheat Sheet

## V6: Authentication

### V6.1 Authentication Documentation

Credential Stuffing Prevention Cheat Sheet

### V6.2 Password Security

Authentication Cheat Sheet

### V6.3 General Authentication Security

Authentication Cheat Sheet

Credential Stuffing Prevention Cheat Sheet

Forgot Password Cheat Sheet

### V6.4 Authentication Factor Lifecycle and Recovery

Choosing and Using Security Questions Cheat Sheet

Forgot Password Cheat Sheet

Multifactor Authentication Cheat Sheet

### V6.5 General Multi-factor authentication requirements

Authentication Cheat Sheet

Multifactor Authentication Cheat Sheet

Password Storage Cheat Sheet

Transaction Authorization Cheat Sheet

### V6.6 Out-of-Band authentication mechanisms

Forgot Password Cheat Sheet

Multifactor Authentication Cheat Sheet

### V6.7 Cryptographic authentication mechanism

Authentication Cheat Sheet

Multifactor Authentication Cheat Sheet

### V6.8 Authentication with an Identity Provider

Authentication Cheat Sheet

## V7: Session Management

Session Management Cheat Sheet

### V7.1 Session Management Documentation

Session Management Cheat Sheet

### V7.2 Fundamental Session Management Security

Session Management Cheat Sheet

### V7.3 Session Timeout

Session Management Cheat Sheet

### V7.4 Session Termination

Session Management Cheat Sheet

### V7.5 Defenses Against Session Abuse

Session Management Cheat Sheet

### V7.6 Federated Re-authentication

Session Management Cheat Sheet

## V8: Authorization

### V8.1 Authorization Documentation

Authorization Cheat Sheet

Authorization Testing Automation

### V8.2 General Authorization Design

Authorization Cheat Sheet

Insecure Direct Object Reference Prevention Cheat Sheet

Session Management Cheat Sheet

### V8.3 Operation Level Authorization

Transaction Authorization Cheat Sheet

### V8.4 Other Authorization Considerations

Authorization Cheat Sheet

Multi-Tenant Application Security Cheat Sheet

## V9: Self-contained Tokens

### V9.1 Token source and integrity

JSON Web Token Cheat Sheet for Java

SAML Security Cheat Sheet

### V9.2 Token content

REST Security Cheat Sheet

## V10: OAuth and OIDC

### V10.1 Generic OAuth and OIDC Security

OAuth 2.0 Protocol Cheatsheet

### V10.2 OAuth Client

OAuth 2.0 Protocol Cheatsheet

### V10.3 OAuth Resource Server

OAuth 2.0 Protocol Cheatsheet

Transport Layer Security Cheat Sheet

### V10.4 OAuth Authorization Server

OAuth 2.0 Protocol Cheatsheet

Transport Layer Security Cheat Sheet

Unvalidated Redirects and Forwards Cheat Sheet

### V10.5 OIDC Client

OAuth 2.0 Protocol Cheatsheet

### V10.6 OpenID Provider

OAuth 2.0 Protocol Cheatsheet

### V10.7 Consent Management

Browser Extension Security Vulnerabilities

Logging Cheat Sheet

## V11: Cryptography

### V11.1 Cryptographic Inventory and Documentation

Cryptographic Storage Cheat Sheet

Key Management Cheat Sheet

### V11.2 Secure Cryptography Implementation

Cryptographic Storage Cheat Sheet

### V11.3 Encryption Algorithms

Cryptographic Storage Cheat Sheet

Key Management Cheat Sheet

### V11.4 Hashing and Hash-based Functions

Password Storage Cheat Sheet

### V11.5 Random Values

Cryptographic Storage Cheat Sheet

### V11.6 Public Key Cryptography

Transport Layer Security Cheat Sheet

### V11.7 In-Use Data Cryptography

Key Management Cheat Sheet

Microservices Security Cheat Sheet

Secrets Management Cheat Sheet

## V12: Secure Communication

### V12.1 General TLS Security Guidance

Transport Layer Security Cheat Sheet

### V12.2 HTTPS Communication with External Facing Services

Transport Layer Security Cheat Sheet

### V12.3 General Service to Service Communication Security

Transport Layer Security Cheat Sheet

## V13: Configuration

### V13.1 Configuration Documentation

Server Side Request Forgery Prevention Cheat Sheet

### V13.2 Backend Communication Configuration

Docker Security Cheat Sheet

Server Side Request Forgery Prevention Cheat Sheet

### V13.3 Secret Management

Cryptographic Storage Cheat Sheet

Key Management Cheat Sheet

### V13.4 Unintended Information Leakage

Django Cheat Sheet

GraphQL Cheat Sheet

Laravel Cheat Sheet

NPM Security best practices

Symfony Cheat Sheet

## V14: Data Protection

### V14.1 Data Protection Documentation

Abuse Case Cheat Sheet

Cryptographic Storage Cheat Sheet

User Privacy Protection Cheat Sheet

### V14.2 General Data Protection

HTML5 Security Cheat Sheet

User Privacy Protection Cheat Sheet

### V14.3 Client-side Data Protection

HTML5 Security Cheat Sheet

## V15: Secure Coding and Architecture

### V15.1: Secure Coding and Architecture Documentation

Abuse Case Cheat Sheet

Attack Surface Analysis Cheat Sheet

Dependency Graph & SBOM Best Practices Cheat Sheet

Software Supply Chain Security

Third Party Javascript Management Cheat Sheet

Threat Modeling Cheat Sheet

### V15.2: Security Architecture and Dependencies

Software Supply Chain Security

Third Party Javascript Management Cheat Sheet

Virtual Patching Cheat Sheet

Vulnerable Dependency Management Cheat Sheet

### V15.3: Defensive Coding

Mass Assignment Cheat Sheet

Prototype Pollution Prevention Cheat Sheet

Unvalidated Redirects and Forwards Cheat Sheet

### V15.4: Safe Concurrency

Secure Code Review Cheat Sheet

Transaction Authorization Cheat Sheet

## V16: Security Logging and Error Handling

### V16.1: Security Logging Documentation

Logging Cheat Sheet

Logging Vocabulary Cheat Sheet

### V16.2: General Logging

Logging Cheat Sheet

Session Management Cheat Sheet

### V16.3: Security Events

Authorization Cheat Sheet

Logging Cheat Sheet

Logging Vocabulary Cheat Sheet

### V16.4: Log Protection

Logging Cheat Sheet

### V16.5: Error Handling

Error Handling Cheat Sheet

## V17: WebRTC

### V17.1 TURN Server

None.

## V17.2 Media

Transport Layer Security Cheat Sheet

## V17.3 Signaling

None.