OWASPASVS 5.0 requirement
ASVS-V16.2.5 When logging sensitive data, the application enforces logging based on the data's protection level.
- Standard
- OWASP ASVS 5.0
- Chapter
- V16 Security Logging and Error Handling
- Section
- V16.2 General Logging
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.