General Authorization Design
V8.2.1
Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 1, 116, 122, 133, 176, 179, 180, 207, 212, 554, 58, 75
V8.2.2
Verify that the application ensures that data-specific access is restricted to consumers with explicit permissions to specific data items to mitigate insecure direct object reference (IDOR) and broken object level authorization (BOLA).
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 122, 180, 212, 383, 58
V8.2.3
Verify that the application ensures that field-level access is restricted to consumers with explicit permissions to specific fields to mitigate broken object property level authorization (BOPLA).
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 122, 180, 212, 383, 58
V8.2.4
Verify that adaptive security controls based on a consumer's environmental and contextual attributes (such as time of day, location, IP address, or device) are implemented for authentication and authorization decisions, as defined in the application's documentation. These controls must be applied when the consumer tries to start a new session and also during an existing session.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 176, 180, 195, 383, 465, 510, 543, 554, 593, 633, 98
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
