Level 1 controls
Level 1 contains 70 controls listed below:
01-encoding-and-sanitization
02-injection-prevention
- V1.2.1 Output encoding for an http response, html documen ...
- V1.2.2 When dynamically building urls, untrusted data is ...
- V1.2.3 Output encoding or escaping is used when dynamical ...
- V1.2.4 Data selection or database queries (e.g., sql, hql ...
- V1.2.5 The application protects against os command inject ...
03-sanitization
- V1.3.1 All untrusted html input from wysiwyg editors or s ...
- V1.3.2 The application avoids the use of eval() or other ...
05-safe-deserialization
- V1.5.1 The application configures xml parsers to use a re ...
02-validation-and-business-logic
01-validation-and-business-logic-documentation
- V2.1.1 The application's documentation defines input vali ...
02-input-validation
- V2.2.1 Input is validated to enforce business or function ...
- V2.2.2 The application is designed to enforce input valid ...
03-business-logic-security
- V2.3.1 The application will only process business logic f ...
03-web-frontend-security
02-unintended-content-interpretation
- V3.2.1 Security controls are in place to prevent browsers ...
- V3.2.2 Content intended to be displayed as text, rather t ...
03-cookie-setup
- V3.3.1 Cookies have the 'secure' attribute set, and if th ...
04-browser-security-mechanism-headers
- V3.4.1 A strict-transport-security header field is includ ...
- V3.4.2 The cross-origin resource sharing (cors) access-co ...
05-browser-origin-separation
- V3.5.1 , if the application does not rely on the cors pre ...
- V3.5.2 , if the application relies on the cors preflight ...
- V3.5.3 Http requests to sensitive functionality use appro ...
04-api-and-web-service
01-generic-web-service-security
- V4.1.1 Every http response with a message body contains a ...
04-websocket
- V4.4.1 Websocket over tls (wss) is used for all websocket ...
05-file-handling
02-file-upload-and-content
- V5.2.1 The application will only accept files of a size w ...
- V5.2.2 When the application accepts a file, either on its ...
03-file-storage
- V5.3.1 Files uploaded or generated by untrusted input and ...
- V5.3.2 When the application creates file paths for file o ...
06-authentication
01-authentication-documentation
- V6.1.1 Application documentation defines how controls suc ...
02-password-security
- V6.2.1 User set passwords are at least 8 characters in le ...
- V6.2.2 Users can change their password. ...
- V6.2.3 Password change functionality requires the user's ...
- V6.2.4 Passwords submitted during account registration or ...
- V6.2.5 Passwords of any composition can be used, without ...
- V6.2.6 Password input fields use type=password to mask th ...
- V6.2.7 "paste" functionality, browser password helpers, a ...
- V6.2.8 The application verifies the user's password exact ...
03-general-authentication-security
- V6.3.1 Controls to prevent attacks such as credential stu ...
- V6.3.2 Default user accounts (e.g., "root", "admin", or " ...
04-authentication-factor-lifecycle-and-recovery
- V6.4.1 System generated initial passwords or activation c ...
- V6.4.2 Password hints or knowledge-based authentication ( ...
07-session-management
02-fundamental-session-management-security
- V7.2.1 The application performs all session token verific ...
- V7.2.2 The application uses either self-contained or refe ...
- V7.2.3 If reference tokens are used to represent user ses ...
- V7.2.4 The application generates a new session token on u ...
04-session-termination
- V7.4.1 When session termination is triggered (such as log ...
- V7.4.2 The application terminates all active sessions whe ...
08-authorization
01-authorization-documentation
- V8.1.1 Authorization documentation defines rules for rest ...
02-general-authorization-design
- V8.2.1 The application ensures that function-level access ...
- V8.2.2 The application ensures that data-specific access ...
03-operation-level-authorization
- V8.3.1 The application enforces authorization rules at a ...
09-self-contained-tokens
01-token-source-and-integrity
- V9.1.1 Self-contained tokens are validated using their di ...
- V9.1.2 Only algorithms on an allowlist can be used to cre ...
- V9.1.3 Key material that is used to validate self-contain ...
02-token-content
- V9.2.1 , if a validity time span is present in the token ...
10-oauth-and-oidc
04-oauth-authorization-server
- V10.4.1 The authorization server validates redirect uris b ...
- V10.4.2 , if the authorization server returns the authoriz ...
- V10.4.3 The authorization code is short-lived. the maximum ...
- V10.4.4 For a given client, the authorization server only ...
- V10.4.5 The authorization server mitigates refresh token r ...
11-cryptography
03-encryption-algorithms
- V11.3.1 Insecure block modes (e.g., ecb) and weak padding ...
- V11.3.2 Only approved ciphers and modes such as aes with g ...
04-hashing-and-hash-based-functions
- V11.4.1 Only approved hash functions are used for general ...
12-secure-communication
01-general-tls-security-guidance
- V12.1.1 Only the latest recommended versions of the tls pr ...
02-https-communication-with-external-facing-services
- V12.2.1 Tls is used for all connectivity between a client ...
- V12.2.2 External facing services use publicly trusted tls ...
13-configuration
04-unintended-information-leakage
- V13.4.1 The application is deployed either without any sou ...
14-data-protection
02-general-data-protection
- V14.2.1 Sensitive data is only sent to the server in the h ...
03-client-side-data-protection
- V14.3.1 Authenticated data is cleared from client storage, ...
15-secure-coding-and-architecture
01-secure-coding-and-architecture-documentation
- V15.1.1 Application documentation defines risk based remed ...
02-security-architecture-and-dependencies
- V15.2.1 The application only contains components which hav ...
03-defensive-coding
- V15.3.1 The application only returns the required subset o ...
