ASVS 5.0 Requirements

ASVS 5.0 Requirements

Structured access to OWASP Application Security Verification Standard (ASVS) 5.0 requirements for security auditing.

When to Use This Skill

• Planning security audits - To understand which chapters apply to the project
• Scoping audit depth - To select appropriate verification level (L1/​L2/​L3)
• Building auditor agents - To define specific checks for each domain
• Mapping findings - To reference ASVS requirements in audit reports

When NOT to Use This Skill

• Quick vulnerability checks - Use vulnerability-patterns skill instead
• Remediation guidance - Use remediation-library skill instead
• Non-ASVS audits - Use industry compliance auditors directly

ASVS Verification Levels

Mapping to Audit Modes:

• Quick Scan → L1 requirements only
• Standard Audit → L1 + L2 requirements
• Comprehensive Audit → L1 + L2 + L3 requirements

---

Chapter Overview

---

V1: Encoding and Sanitization (28 requirements)

Control Objective

Ensure the application correctly encodes and decodes data to prevent injection attacks.

Sections

• V1.1 Encoding Architecture
• V1.2 Injection Prevention
• V1.3 Sanitization
• V1.4 Memory/​String Safety
• V1.5 Safe Deserialization

Key Requirements

Detection Patterns

• SQL string concatenation: "SELECT * FROM " + table
• Command injection: shell invocation with user input
• Unsafe deserialize: Python object serialization, PHP unserialize

---

V2: Validation and Business Logic (15 requirements)

Control Objective

Ensure input validation enforces business expectations and prevents logic bypass.

Sections

• V2.1 Documentation
• V2.2 Input Validation
• V2.3 Business Logic Security
• V2.4 Anti-automation

Key Requirements

Detection Patterns

• Client-only validation: if (form.valid) without server check
• Missing rate limiting: No throttle on login/​register
• Mass assignment: Accepting all form fields without filtering

---

V3: Web Frontend Security (32 requirements)

Control Objective

Protect browsers against common web attacks through proper headers and configurations.

Sections

• V3.1 Documentation
• V3.2 Content Interpretation
• V3.3 Cookie Setup
• V3.4 Security Headers
• V3.5 Origin Separation
• V3.6 External Resources
• V3.7 Other Browser Security

Key Requirements

Detection Patterns

• Missing CSP: No Content-Security-Policy header
• Insecure cookies: Missing Secure/​HttpOnly flags
• No HSTS: Missing Strict-Transport-Security

---

V4: API and Web Service (17 requirements)

Control Objective

Ensure API endpoints are secure against common attack patterns.

Sections

• V4.1 Generic Web Service Security
• V4.2 HTTP Message Validation
• V4.3 GraphQL
• V4.4 WebSocket

Key Requirements

Detection Patterns

• GraphQL introspection: introspectionQuery enabled
• No depth limit: Unbounded GraphQL queries
• Missing auth: WebSocket without handshake validation

---

V5: File Handling (14 requirements)

Control Objective

Handle files securely throughout upload, storage, and download lifecycle.

Sections

• V5.1 Documentation
• V5.2 File Upload
• V5.3 File Storage
• V5.4 File Download

Key Requirements

Detection Patterns

• No extension check: Accepting any file type
• Path traversal: ../ in filenames not sanitized
• Direct run: Uploads served from code directory

---

V6: Authentication (44 requirements)

Control Objective

Ensure robust authentication mechanisms protect user accounts.

Sections

• V6.1 Documentation
• V6.2 Password Security
• V6.3 General Auth Security
• V6.4 Factor Lifecycle
• V6.5 Multi-factor Auth
• V6.6 Out-of-Band Auth
• V6.7 Cryptographic Auth
• V6.8 Identity Provider Auth

Key Requirements

Detection Patterns

• Weak hashing: MD5/​SHA1 for passwords
• No lockout: Unlimited login attempts
• Plain text: Passwords in logs/​storage

---

V7: Session Management (18 requirements)

Control Objective

Ensure session tokens are generated, managed, and invalidated securely.

Sections

• V7.1 Documentation
• V7.2 Session Token Lifecycle
• V7.3 Session Logout and Timeout
• V7.4 Cookie-based Session Management

Key Requirements

Detection Patterns

• Predictable IDs: Sequential or timestamp-based
• No logout: Missing session invalidation
• No timeout: Sessions never expire

---

V8: Authorization (11 requirements)

Control Objective

Ensure access control is enforced at all levels of the application.

Sections

• V8.1 Documentation
• V8.2 Application Access Control
• V8.3 Directory Browsing and Resource Protection

Key Requirements

Detection Patterns

• Missing IDOR check: Direct object access without ownership validation
• Role bypass: Admin functions without role verification
• Open directories: Index enabled on sensitive paths

---

V9: Self-contained Tokens (7 requirements)

Control Objective

Ensure JWT and similar tokens are implemented securely.

Sections

• V9.1 Documentation
• V9.2 Token Generation
• V9.3 Token Verification

Key Requirements

Detection Patterns

• Weak algorithm: HS256 with weak secret
• None algorithm: alg: "none" accepted
• No expiry: Missing or ignored exp claim

---

V10: OAuth and OIDC (50 requirements)

Control Objective

Ensure OAuth 2.0 and OpenID Connect implementations follow security best practices.

Sections

• V10.1 Documentation
• V10.2 OAuth Client
• V10.3 OAuth Authorization Server
• V10.4 OAuth Resource Server
• V10.5 OIDC Client
• V10.6 OIDC Provider

Key Requirements

Detection Patterns

• Missing PKCE: Public clients without code_challenge
• Open redirect: Insufficient redirect_uri validation
• Token in URL: Access token exposed in query params

---

V11: Cryptography (32 requirements)

Control Objective

Ensure cryptographic implementations use secure algorithms and configurations.

Sections

• V11.1 Documentation
• V11.2 Key Management
• V11.3 Random Values
• V11.4 Symmetric Encryption
• V11.5 Hashing and Hash-based Functions

Key Requirements

Detection Patterns

• Hardcoded keys: secretKey = "..." in code
• Weak PRNG: Math.random() for tokens
• Deprecated crypto: DES, RC4, MD5 usage

---

V12: Secure Communications (13 requirements)

Control Objective

Ensure all communications use secure transport layer protocols.

Sections

• V12.1 Documentation
• V12.2 TLS Configuration
• V12.3 Certificate Validation

Key Requirements

Detection Patterns

• TLS disabled: verify=False, NODE_TLS_REJECT_UNAUTHORIZED=0
• Weak TLS: SSLv3, TLS 1.0/​1.1 enabled
• Self-signed: Non-CA certs in production

---

V13: Configuration (18 requirements)

Control Objective

Ensure secure default configurations and proper secrets management.

Sections

• V13.1 Documentation
• V13.2 Build and Deployment Configuration
• V13.3 Secrets Management
• V13.4 Dependency Management

Key Requirements

Detection Patterns

• Debug enabled: DEBUG=True in production
• Secrets in git: API keys in committed files
• Outdated deps: Known vulnerable packages

---

V14: Data Protection (15 requirements)

Control Objective

Ensure sensitive data is identified, classified, and protected appropriately.

Sections

• V14.1 Documentation
• V14.2 Data Classification
• V14.3 Data at Rest
• V14.4 Data in Transit

Key Requirements

Detection Patterns

• Unencrypted PII: Plain text storage of personal data
• No column encryption: Sensitive fields not encrypted
• HTTP endpoints: Sensitive data sent over HTTP

---

V15: Secure Coding (20 requirements)

Control Objective

Ensure code follows secure development practices.

Sections

• V15.1 Documentation
• V15.2 Memory Safety
• V15.3 Code Quality
• V15.4 Dependency Management

Key Requirements

Detection Patterns

• Buffer issues: Unbounded array access
• Dead code: Unreachable branches
• Vulnerable deps: CVEs in dependencies

---

V16: Security Logging (19 requirements)

Control Objective

Ensure security events are logged with appropriate detail for incident response.

Sections

• V16.1 Documentation
• V16.2 Event Content
• V16.3 Log Protection
• V16.4 Error Handling

Key Requirements

Detection Patterns

• No auth logging: Login attempts not recorded
• PII in logs: Passwords/​tokens logged
• Verbose errors: Stack traces to users

---

V17: WebRTC (15 requirements)

Control Objective

Ensure WebRTC implementations are secure.

Sections

• V17.1 Documentation
• V17.2 WebRTC Security

Key Requirements

Detection Patterns

• No encryption: Unencrypted media streams
• Open signaling: Unauthenticated signaling server
• ICE leaks: Exposing internal IPs

---

Feature-to-Chapter Mapping

Use this to select relevant chapters based on project features:

---

External Resources

• ASVS 5.0 Full Specification: https://raw.githubusercontent.com/OWASP/ASVS/v5.0.0/5.0/docs_en/OWASP_Application_Security_Verification_Standard_5.0.0_en.csv
• OWASP ASVS Project: https://owasp.org/www-project-application-security-verification-standard/
• Secure Coding Rules: ~/​projects/​claude-secure-coding-rules/

See Also

• Skill: project-context - Detect project features for chapter selection
• Skill: vulnerability-patterns - Language-specific vulnerability patterns
• Skill: remediation-library - Fix patterns for findings