OWASPASVS 5.0 requirement

ASVS-V14.3.3 Data stored in browser storage (such as localstorage, sessionstorage, indexeddb, or cookies) does not contain sensitive data, with the…

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V14 Data Protection
Section: V14.3 Client-side Data Protection
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of session tokens.