ESAPI Charter

ESAPI Charter

The goal of the OWASP ESAPI Project is to ensure:

  strong simple security controls are available
  to every developer in every environment

Strong

Strong controls do not contain vulnerabilities and provide complete protection against the threats they were designed for.

Simple

Controls that are not easy to use will most likely be misused by developers and create vulnerability

Available

Controls are available if they are present in the developer's environment in a way that makes them easy and obvious to use. The goal of the ESAPI project is not to replace good security controls that are already available in programming environments. Nor is it our goal to make developers access security controls directly. It's even better if the controls are already present or are integrated into a framework in a way that is invisible or automatic to developers.

Every Developer

It is difficult to imagine a developer that does not need a set of basic security controls in their environment, from students to senior architects.

Every Environment

Our initial target is server-side web environments, then we plan to extend to both web service environments and client side frameworks, and eventually other non-web programming environments.

Coverage

Obviously we cannot provide security controls in every environment all at once. Therefore, we've decided to focus on several key software environments that are widely used and we will expand the list over time. Here is our current scorecard:

Security Area	Java EE	.NET	PHP	Classic ASP	Haskell	Cold Fusion
Authentication	©	©
Session Management	©
Access Control	©
Input Validation	©
Canonicalization	©
Output Encoding	©
Security Exceptions	©
Security Logging	©
Intrusion Detection	©
Encryption	©
Randomness	©
HTTP Protections	©