OWASPASVS 5.0 requirement
ASVS-V13.2.1 Communications between backend application components that don't support the application's standard user session mechanism, including apis,…
- Standard
- OWASP ASVS 5.0
- Chapter
- V13 Configuration
- Section
- V13.2 Backend Communication Configuration
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.