OWASPASVS 5.0 requirement
ASVS-V15.3.3 The application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g.,…
- Standard
- OWASP ASVS 5.0
- Chapter
- V15 Secure Coding and Architecture
- Section
- V15.3 Defensive Coding
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.