CAPEC™ 39: Manipulating Opaque Client-based Data Tokens
Description
In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampering through use of encryption or obfuscation.
Source: CAPEC™ 39
Related ASVS Requirements
ASVS (5.0): 10.3.1, 10.4.1, 10.4.16, 10.5.4, 10.5.5, 11.2.1, 11.2.3, 11.2.4, 11.2.5, 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.4.1, 11.4.3, 11.5.1, 11.5.2, 11.6.1, 11.6.2, 12.1.1, 12.1.2, 12.1.3, 12.1.4, 12.2.1, 12.2.2, 12.3.1, 12.3.2, 12.3.3, 12.3.4, 12.3.5, 14.2.4, 15.3.7, 16.3.1, 16.3.2, 16.3.3, 16.3.4, 2.3.1, 2.3.4, 2.3.5, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.1, 3.7.4, 4.1.2, 4.1.3, 4.1.5, 6.7.1, 8.3.1, 9.1.3, 9.2.2, 9.2.3, 9.2.4
