Home >> Taxonomy >> Asvs 4.0.3 >> 01 architecture design and threat modeling >> 04 access control architecture

Access Control Architecture

V1.4.1

Verify that trusted enforcement points, such as access control gateways, servers, and serverless functions, enforce access controls. Never enforce access controls on the client.

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 602

V1.4.2

[DELETED, NOT ACTIONABLE]

Level 1 required: False

Level 2 required: False

Level 3 required: False

CWE:

V1.4.3

[DELETED, DUPLICATE OF 4.1.3]

Level 1 required: False

Level 2 required: False

Level 3 required: False

CWE:

V1.4.4

Verify the application uses a single and well-vetted access control mechanism for accessing protected data and resources. All requests must pass through this single mechanism to avoid copy and paste or insecure alternative paths. (C7)

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 284

V1.4.5

Verify that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles. (C7)

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 275

Disclaimer:

Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.

View source on GitHub

Loading comments 0%