1.4.2 - [Clarification/For Discussion] for "flexible" access control solution

[csfreak92]

ASVS 4.0 - 1.4.2 verification requirement is:

Verify that the chosen access control solution is flexible enough to meet the application's needs.

This control is too vague, what does it mean by having a flexible access control solution? Maybe this be expanded to explain to developers and tester what this requirement really means?

[jmanico]

I’d just drop this one. It‘s not helpful.

…

-- Jim Manico @manicode Secure Coding Education +1 (808) 652-3805

On Apr 17, 2020, at 12:01 PM, csfreak92 ***@***.***> wrote:  ASVS 4.0 - 1.4.2 verification requirement is: Verify that the chosen access control solution is flexible enough to meet the application's needs. This control is too vague, what does it mean by having a flexible access control solution? Maybe this be expanded to explain to developers and tester what this requirement really means? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[csfreak92]

Hi @jmanico, do you mean you would drop this 1.4.2 verification requirement for the next ASVS iteration? Or was my open issue not helping as well?

[jmanico]

I think you’re exactly right. This requirement is too vague. I suggest we drop this requirement as you suggested in the next ASVS version.

…

-- Jim Manico @manicode

On Apr 17, 2020, at 5:34 PM, csfreak92 ***@***.***> wrote:  Hi @jmanico, do you mean you would drop this 1.4.2 verification requirement for the next ASVS iteration? Or was my open issue not helping as well? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[elarlang]

One thing less to report :)

@jmanico Peale set milestone 4.1 to the issue, then it's clear and easy to follow.

[tghosth]

Done, leaving this for when we prepare 4.1

[csfreak92]

@tghosth, shall I create a pull request ready to remove this control?

[tghosth]

let's leave this open for now. I am not sure if we want a PR at this point for something relatively basic. We currently have a discussion about releasing a 4.0.2 (#750) so I am not running to change requirements at this point.

[jmanico]

Hey @csfreak92 we'll take that PR now please!

[jmanico]

Completed here 480bb9d and closing this out