OWASPASVS 5.0 requirement
ASVS-V4.1.3 Any http header field used by the application and set by an intermediary layer, such as a load balancer, a web proxy, or a…
- Standard
- OWASP ASVS 5.0
- Chapter
- V4 API and Web Service
- Section
- V4.1 Generic Web Service Security
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that any HTTP header field used by the application and set by an intermediary layer, such as a load balancer, a web proxy, or a backend-for-frontend service, cannot be overridden by the end-user. Example headers might include X-Real-IP, X-Forwarded-*, or X-User-ID.