Browser Security Mechanism Headers
V3.4.1
Verify that a Strict-Transport-Security header field is included on all responses to enforce an HTTP Strict Transport Security (HSTS) policy. A maximum age of at least 1 year must be defined, and for L2 and up, the policy must apply to all subdomains as well.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 157, 21, 22, 220, 31, 39, 466, 593, 594, 620, 89, 94
V3.4.2
Verify that the Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header field is a fixed value by the application, or if the Origin HTTP request header field value is used, it is validated against an allowlist of trusted origins. When 'Access-Control-Allow-Origin: *' needs to be used, verify that the response does not include any sensitive information.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 104, 173, 21, 22, 233, 466
V3.4.3
Verify that HTTP responses include a Content-Security-Policy response header field which defines directives to ensure the browser only loads and executes trusted content or resources, in order to limit execution of malicious JavaScript. As a minimum, a global policy must be used which includes the directives object-src 'none' and base-uri 'none' and defines either an allowlist or uses nonces or hashes. For an L3 application, a per-response policy with nonces or hashes must be defined.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 103, 104, 111, 152, 160, 173, 19, 207, 21, 22, 233, 242, 446, 63, 89
V3.4.4
Verify that all HTTP responses contain an 'X-Content-Type-Options: nosniff' header field. This instructs browsers not to use content sniffing and MIME type guessing for the given response, and to require the response's Content-Type header field value to match the destination resource. For example, the response to a request for a style is only accepted if the response's Content-Type is 'text/css'. This also enables the use of the Cross-Origin Read Blocking (CORB) functionality by the browser.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 152, 19, 21, 22, 569, 63, 690
V3.4.5
Verify that the application sets a referrer policy to prevent leakage of technically sensitive data to third-party services via the 'Referer' HTTP request header field. This can be done using the Referrer-Policy HTTP response header field or via HTML element attributes. Sensitive data could include path and query data in the URL, and for internal non-public applications also the hostname.
Required for Level 2 and 3
Related CAPEC™ Requirements
V3.4.6
Verify that the web application uses the frame-ancestors directive of the Content-Security-Policy header field for every HTTP response to ensure that it cannot be embedded by default and that embedding of specific resources is allowed only when necessary. Note that the X-Frame-Options header field, although supported by browsers, is obsolete and may not be relied upon.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 103, 104, 111, 152, 160, 173, 19, 21, 22, 233, 242, 446, 63
V3.4.7
Verify that the Content-Security-Policy header field specifies a location to report violations.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 103, 104, 111, 152, 160, 173, 19, 207, 21, 22, 233, 242, 446, 63, 89
V3.4.8
Verify that all HTTP responses that initiate a document rendering (such as responses with Content-Type text/html), include the CrossOriginOpenerPolicy header field with the same-origin directive or the same-origin-allow-popups directive as required. This prevents attacks that abuse shared access to Window objects, such as tabnabbing and frame counting.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 104, 152, 160, 173, 19, 233, 466, 543, 569, 63
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
