OWASPASVS 5.0 requirement
ASVS-V15.3.4 All proxying and middleware components transfer the user's original ip address correctly using trusted data fields that cannot be…
- Standard
- OWASP ASVS 5.0
- Chapter
- V15 Secure Coding and Architecture
- Section
- V15.3 Defensive Coding
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that all proxying and middleware components transfer the user's original IP address correctly using trusted data fields that cannot be manipulated by the end user, and the application and web server use this correct value for logging and security decisions such as rate limiting, taking into account that even the original IP address may not be reliable due to dynamic IPs, VPNs, or corporate firewalls.