This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Cornucopia - Ecommerce Website - AT 8"
(Created page with "{{DISPLAYTITLE:<span style="padding:2px 5px 0px 5px;color:white;background:#73abcc;">Cornucopia - Ecommerce Website - AT 8</span>}} File:Cornucopia_-_Ecommerce_Website_AT_8....") |
|||
| Line 35: | Line 35: | ||
</tr> | </tr> | ||
</table> | </table> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Latest revision as of 16:19, 21 January 2016
Suit: Authentication
Card/Value: 8
Description:
Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access).
Technical Note:
Once an authentication failure is detected, access needs to be blocked. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
NB: the key concept for this card is permitting access, even though authentication checks were undertaken and detected a failure. See AT 4 for the similar authorization failure.
References:
| OWASP SCP | OWASP ASVS | OWASP AppSensor | CAPEC | SAFECODE |
|---|---|---|---|---|
| 28 | 2.6 | 115 | 28 |
