This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "ESAPI Secure Coding Guideline"

From OWASP
Jump to: navigation, search
(New page: ==Access Control== {|class="wikitable sortable" style="text-align:left;" width="100%" |- ! ID ! width="45%" | Requirement ! width="45%" | Code Example |- | '''AC001''' | LU | Y |- | '''A...)
 
Line 1: Line 1:
 +
=Using Security Controls=
 +
 +
==Authentication==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AU001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 +
 +
 +
==Session Management==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 +
 +
 +
 +
 +
 +
 +
 +
 
==Access Control==
 
==Access Control==
−
{|class="wikitable sortable" style="text-align:left;" width="100%"
+
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code>assertAuthorizedForURL()</code> to verify authorization before allowing access to each URL.
 +
| TBD
 +
|-
 +
| align="center" | '''AC002'''
 +
| The application shall use <code>assertAuthorizedForFunction()</code> to verify authorization before allowing access to each business function.
 +
| TBD
 +
|-
 +
| align="center" | '''AC003'''
 +
| The application shall use <code>assertAuthorizedForFile()</code> to verify authorization before allowing access to files.
 +
| TBD
 +
|-
 +
| align="center" | '''AC004'''
 +
| The application shall use <code>assertAuthorizedForData()</code> to verify authorization  before allowing access to data.
 +
| TBD
 +
|-
 +
| align="center" | '''AC005'''
 +
| The application shall use <code>assertAuthorizedForService()</code> to verify authorization before allowing access to each backend service.
 +
| TBD
 +
|-
 +
| align="center" | '''AC006'''
 +
| The application shall use <code>isAuthorizedFor*</code> methods to verify authorization before including user interface controls in HTML output.
 +
| TBD
 +
|-
 +
| align="center" | '''AC007'''
 +
| The application shall use <code>AccessReferenceMap.getIndirectReference()</code> to reference all application objects such as filenames, directory paths, and database keys.
 +
| TBD
 +
|-
 +
| align="center" | '''AC008'''
 +
| The application shall prevent access to all resources that should not be directly accessed by users (such as resources, XML files, JSP files, properties) by storing them in a protected directory, such as <code>WEB-INF</code>.
 +
| TBD
 +
|-
 +
| align="center" | '''AC009'''
 +
| The application shall use <code>HTTPUtilities.sendSafeForward()</code> for all forwards, to ensure that they cannot be used to bypass access checks.
 +
| TBD
 +
|-
 +
| align="center" | '''AC0010'''
 +
| The appplication must use only trusted data used in access control decisions.
 +
| TBD
 +
|-
 +
| align="center" | '''AC0011'''
 +
| Administrative functions for the application shall be deployed as a separate application with increased authentication controls.
 +
| TBD
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
 
 +
==Input Validation and Encoding==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
 
 +
==Data Protection==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
==Using Services Securely==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
 
 +
==Error Handling==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
 
 +
==Logging and Intrusion Detection==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
 
 +
 
 +
==Secure Configuration and Deployment==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 
|-
 
|-
 
! ID
 
! ID
Line 7: Line 170:
 
|-  
 
|-  
 
| '''AC001'''
 
| '''AC001'''
−
| LU
+
| The application shall use <code></code> to
−
| Y
+
|}
 +
 
 +
 
 +
 
 +
 
 +
 
 +
=Preventing Specific Risks=
 +
 
 +
==Cross Site Scripting==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
==Cross Site Request Forgery==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 +
|-
 +
| align="center" | '''AC001'''
 +
| The application shall use <code></code> to
 +
|}
 +
 
 +
 
 +
==Denial of Service==
 +
{|class="wikitable" style="text-align:left;" width="100%"
 +
|-
 +
! ID
 +
! width="45%" | Requirement
 +
! width="45%" | Code Example
 
|-  
 
|-  
−
| '''AC002'''
+
| align="center" | '''AC001'''
−
| LU
+
| The application shall use <code></code> to
−
| Y
 
 
|}
 
|}

Revision as of 14:52, 14 April 2008

Using Security Controls

Authentication

ID Requirement Code Example
AU001 The application shall use to


Session Management

ID Requirement Code Example
AC001 The application shall use to





Access Control

ID Requirement Code Example
AC001 The application shall use assertAuthorizedForURL() to verify authorization before allowing access to each URL. TBD
AC002 The application shall use assertAuthorizedForFunction() to verify authorization before allowing access to each business function. TBD
AC003 The application shall use assertAuthorizedForFile() to verify authorization before allowing access to files. TBD
AC004 The application shall use assertAuthorizedForData() to verify authorization before allowing access to data. TBD
AC005 The application shall use assertAuthorizedForService() to verify authorization before allowing access to each backend service. TBD
AC006 The application shall use isAuthorizedFor* methods to verify authorization before including user interface controls in HTML output. TBD
AC007 The application shall use AccessReferenceMap.getIndirectReference() to reference all application objects such as filenames, directory paths, and database keys. TBD
AC008 The application shall prevent access to all resources that should not be directly accessed by users (such as resources, XML files, JSP files, properties) by storing them in a protected directory, such as WEB-INF. TBD
AC009 The application shall use HTTPUtilities.sendSafeForward() for all forwards, to ensure that they cannot be used to bypass access checks. TBD
AC0010 The appplication must use only trusted data used in access control decisions. TBD
AC0011 Administrative functions for the application shall be deployed as a separate application with increased authentication controls. TBD



Input Validation and Encoding

ID Requirement Code Example
AC001 The application shall use to



Data Protection

ID Requirement Code Example
AC001 The application shall use to



Using Services Securely

ID Requirement Code Example
AC001 The application shall use to



Error Handling

ID Requirement Code Example
AC001 The application shall use to



Logging and Intrusion Detection

ID Requirement Code Example
AC001 The application shall use to



Secure Configuration and Deployment

ID Requirement Code Example
AC001 The application shall use to



Preventing Specific Risks

Cross Site Scripting

ID Requirement Code Example
AC001 The application shall use to


Cross Site Request Forgery

ID Requirement Code Example
AC001 The application shall use to


Denial of Service

ID Requirement Code Example
AC001 The application shall use to
Retrieved from "https://wiki.owasp.org/index.php?title=ESAPI_Secure_Coding_Guideline&oldid=28028"