OWASPASVS 5.0 requirement
ASVS-V3.5.7 Data requiring authorization is not included in script resource responses, like javascript files, to prevent cross-site script inclusion…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.5 Browser Origin Separation
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that data requiring authorization is not included in script resource responses, like JavaScript files, to prevent Cross-Site Script Inclusion (XSSI) attacks.