OWASPASVS 5.0 requirement

ASVS-V14.2.1 Sensitive data is only sent to the server in the http message body or header fields, and that the url and query string do not contain…

L1 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V14 Data Protection
Section: V14.2 General Data Protection
Level: L1 (requirement applies from this verification level up)

Requirement

Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.