Operation Level Authorization
V8.3.1
Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 1, 121, 156, 162, 166, 172, 176, 179, 180, 207, 212, 22, 36, 39, 554, 74, 95
V8.3.2
Verify that changes to values on which authorization decisions are made are applied immediately. Where changes cannot be applied immediately, (such as when relying on data in self-contained tokens), there must be mitigating controls to alert when a consumer performs an action when they are no longer authorized to do so and revert the change. Note that this alternative would not mitigate information leakage.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 156, 176, 554, 593
V8.3.3
Verify that access to an object is based on the originating subject's (e.g. consumer's) permissions, not on the permissions of any intermediary or service acting on their behalf. For example, if a consumer calls a web service using a self-contained token for authentication, and the service then requests data from a different service, the second service will use the consumer's token, rather than a machine-to-machine token from the first service, to make permission decisions.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 156, 176, 233, 234, 240, 30, 554, 69
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
