OWASP Annotated Application Security Verification Standard
latest

Browse by chapter:

  • v1 Architecture, design and threat modelling
  • v2 Authentication verification requirements
  • v3 Session management verification requirements
  • v4 Access control verification requirements
  • v5 Malicious input handling verification requirements
  • v6 Output encoding / escaping
  • v7 Cryptography at rest verification requirements
  • v8 Error handling and logging verification requirements
  • v9 Data protection verification requirements
  • v10 Communications security verification requirements
  • v11 HTTP security configuration verification requirements
  • v12 Security configuration verification requirements
  • v13 Malicious controls verification requirements
  • v14 Internal security verification requirements
  • v15 Business logic verification requirements
  • v16 Files and resources verification requirements
  • v17 Mobile verification requirements
  • v18 Web services verification requirements
    • 18.1 Web Service client and server use same encoding
    • 18.2 Web Service admin is limited to admins
    • 18.3 XML or JSON schemas are used properly
    • 18.4 Input is size limited
    • 18.5 SOAP services comply to WS-I Basic Profile
    • 18.6 Session based authentication and authorization is used
    • 18.7 REST service is not vulnerable to CSRF
    • 18.8 REST service verifies Content-Type
    • 18.9 Message payload is signed
    • 18.10 No alternative (insecure) access paths
  • v19 Configuration

Browse by level:

  • Level 1: Opportunistic
  • Level 2: Standard
  • Level 3: Advanced
OWASP Annotated Application Security Verification Standard
  • Docs »
  • v18 Web services verification requirements
  • Edit on GitHub

v18 Web services verification requirementsΒΆ

  • 18.1 Web Service client and server use same encoding
  • 18.2 Web Service admin is limited to admins
  • 18.3 XML or JSON schemas are used properly
  • 18.4 Input is size limited
  • 18.5 SOAP services comply to WS-I Basic Profile
  • 18.6 Session based authentication and authorization is used
  • 18.7 REST service is not vulnerable to CSRF
  • 18.8 REST service verifies Content-Type
  • 18.9 Message payload is signed
  • 18.10 No alternative (insecure) access paths
Next Previous

© Copyright 2015, Boy Baukema Revision 471fcb0a.

Built with Sphinx using a theme provided by Read the Docs.