The Application Security Verification Standard lists 345 testable requirements for web applications and services in 17 chapters. Each chapter page lists its requirements with their level and an anchor, so V8.2.2 opens at its requirement. Cite a requirement with its version, for example v5.0.0-8.2.2.
| Chapter | Summary | Requirements | Guides here |
|---|---|---|---|
| V1 Encoding and Sanitization | Output encoding, injection prevention, sanitization of dangerous content, memory-safe handling and safe deserialization, so untrusted data cannot change how an interpreter behaves. | 30 | 12 |
| V2 Validation and Business Logic | Documented validation rules, positive input validation at a trusted layer, and business-logic protections: step ordering, limits, transactions, locking and anti-automation. | 13 | 6 |
| V3 Web Frontend Security | Browser-side protections: safe rendering, cookie attributes, security headers such as CSP, HSTS and CORS, origin separation against cross-site attacks, and external resource integrity. | 31 | 6 |
| V4 API and Web Service | Correct HTTP message and content-type handling, consistent request framing to prevent smuggling, and specific controls for GraphQL and WebSocket services. | 16 | 4 |
| V5 File Handling | Safe file upload, storage and download: permitted types and sizes, archive limits, server-generated paths, preventing execution of uploaded content and safe filenames on download. | 13 | 2 |
| V6 Authentication | Password rules, general authentication defenses, factor lifecycle and recovery, multi-factor and out-of-band methods, cryptographic authenticators and identity-provider integration. | 47 | 7 |
| V7 Session Management | Session token generation and verification, inactivity and absolute timeouts, termination including on account disable, defenses against session abuse, and federated re-authentication. | 19 | 3 |
| V8 Authorization | Documented authorization rules and their enforcement at function, data and field level on a trusted service layer, including multi-tenant isolation and timely permission changes. | 13 | 11 |
| V9 Self-contained Tokens | Validating self-contained tokens such as JWTs: signature or MAC checks, algorithm allowlists, trusted key sources, validity periods, token type and intended audience. | 7 | 2 |
| V10 OAuth and OIDC | Requirements for OAuth clients, resource servers and authorization servers, OIDC relying parties and providers, and user consent management. | 36 | 3 |
| V11 Cryptography | Cryptographic inventory and key-lifecycle management, approved algorithms and modes, hashing and password storage, randomness, public-key use and migration planning such as post-quantum readiness. | 24 | 17 |
| V12 Secure Communication | TLS versions and cipher suites, certificate validation and trust, and encrypted, authenticated connections for external and service-to-service traffic. | 12 | 8 |
| V13 Configuration | Documented communication and resource needs, secure and least-privilege backend connections, secrets management, and preventing information leakage from deployed configuration. | 21 | 8 |
| V14 Data Protection | Classifying sensitive data and protecting it in transit, in server caches, in client storage and through retention, while returning only the data actually needed. | 13 | 6 |
| V15 Secure Coding and Architecture | Managing dependencies and risky components, defending against costly operations, defensive coding (mass assignment, type confusion, prototype pollution, parameter pollution) and safe concurrency. | 21 | 11 |
| V16 Security Logging and Error Handling | Logging inventory, content and protection, recording security events, encoding log data safely, and generic, fail-safe error handling. | 17 | 3 |
| V17 WebRTC | Hardening WebRTC infrastructure: TURN relay access and exhaustion limits, DTLS/SRTP media protection and resilience, and signaling servers that withstand floods and malformed messages. | 12 | 1 |
Entries from OWASP Application Security Verification Standard 5.0.0 (GitHub release v5.0.0_release). “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.