Skip to content

Commit

Permalink
Update on 0x10-V1-Architecture.md
Browse files Browse the repository at this point in the history
Removal of 1.4.2 - Verify that the chosen access control solution is flexible enough to meet the application's needs from V1.4 Access Control Architectural Requirements. 

This Pull Request relates to issue OWASP#736 as agreed upon to be removed from the standard.
  • Loading branch information
csfreak92 authored Mar 14, 2021
1 parent 5b56b3f commit b9ce9b1
Showing 1 changed file with 4 additions and 5 deletions.
9 changes: 4 additions & 5 deletions 4.0/en/0x10-V1-Architecture.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,10 @@ This is a placeholder for future architectural requirements.
| # | Description | L1 | L2 | L3 | CWE |
| :---: | :--- | :---: | :---:| :---: | :---: |
| **1.4.1** | Verify that trusted enforcement points such as at access control gateways, servers, and serverless functions enforce access controls. Never enforce access controls on the client. | ||| 602 |
| **1.4.2** | Verify that the chosen access control solution is flexible enough to meet the application's needs. | ||| 284 |
| **1.4.3** | Verify enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege. | ||| 272 |
| **1.4.4** | Verify the application uses a single and well-vetted access control mechanism for accessing protected data and resources. All requests must pass through this single mechanism to avoid copy and paste or insecure alternative paths. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 284 |
| **1.4.5** | Verify that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 275 |
| **1.4.6** | [ADDED] Verify that communications between application components, including APIs, middleware and data layers, are performed with the least necessary privileges. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 272 |
| **1.4.2** | Verify enforcement of the principle of least privilege in functions, data files, URLs, controllers, services, and other resources. This implies protection against spoofing and elevation of privilege. | ||| 272 |
| **1.4.3** | Verify the application uses a single and well-vetted access control mechanism for accessing protected data and resources. All requests must pass through this single mechanism to avoid copy and paste or insecure alternative paths. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 284 |
| **1.4.4** | Verify that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles. ([C7](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 275 |
| **1.4.5** | [ADDED] Verify that communications between application components, including APIs, middleware and data layers, are performed with the least necessary privileges. ([C3](https://owasp.org/www-project-proactive-controls/#div-numbering)) | ||| 272 |

## V1.5 Input and Output Architectural Requirements

Expand Down

0 comments on commit b9ce9b1

Please sign in to comment.