Proposal: (sub)category "Client-Side" (browser-side)

elarlang commented 2 years ago

Goal: to cover all requirements, where an application need to check, was a HTTP request made by the browser/client legit or forced by malicious actor from 3rd party site. It includes attack vectors like CSRF, XSSI, ClickJacking, etc.

To which category it should belong, I'm not sure. Just by title, it feels first idea to put to "V9 Communications", but this one seems to be "configuration only" category (the name should say it as well).

Related discussions and issues:

elarlang commented 11 months ago

Elar is working on creating the monster PR for this based on individual commits for each requirement (to help traceability)

my idea is actually a bit the opposite - to avoid monster PR and put the content in with small PRs :)

edit: but the monster arrived...

elarlang commented 11 months ago

The new "Web Frontend Security" category is in place, with temporary number V50.

https://github.com/OWASP/ASVS/blob/master/5.0/en/0x50-V50-Web-Frontend-Security.md

There is still a lot of work to do with that, but for those changes it makes sense to open new issue per topic. As a structure change proposal, we can say it is done.

tghosth commented 10 months ago

Great work @elarlang !

OWASP / ASVS

Proposal: (sub)category "Client-Side" (browser-side) #1230