Other Browser Security Considerations
V3.7.1
Verify that the application only uses client-side technologies which are still supported and considered secure. Examples of technologies which do not meet this requirement include NSAPI plugins, Flash, Shockwave, ActiveX, Silverlight, NACL, or client-side Java applets.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 181, 21, 242, 446
V3.7.2
Verify that the application will only automatically redirect the user to a different hostname or domain (which is not controlled by the application) where the destination appears on an allowlist.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 173, 21, 242, 569
V3.7.3
Verify that the application shows a notification when the user is being redirected to a URL outside of the application's control, with an option to cancel the navigation.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 173, 21, 242, 569, 62
V3.7.4
Verify that the application's top-level domain (e.g., site.tld) is added to the public preload list for HTTP Strict Transport Security (HSTS). This ensures that the use of TLS for the application is built directly into the main browsers, rather than relying only on the Strict-Transport-Security response header field.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 157, 21, 220, 242, 31, 39, 466, 569, 593, 594, 620, 89, 94
V3.7.5
Verify that the application behaves as documented (such as warning the user or blocking access) if the browser used to access the application does not support the expected security features.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 103, 152, 160, 176, 19, 202, 207, 21, 242, 554, 63, 87, 89
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
