OWASPASVS 5.0 requirement

ASVS-V4.2.3 The application does not send nor accept http/2 or http/3 messages with connection-specific header fields such as transfer-encoding to…

L3 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V4 API and Web Service
Section: V4.2 HTTP Message Structure Validation
Level: L3 (requirement applies from this verification level up)

Requirement

Verify that the application does not send nor accept HTTP/2 or HTTP/3 messages with connection-specific header fields such as Transfer-Encoding to prevent response splitting and header injection attacks.