AUTHENTICATION (ATJ)
Mark can access resources or services because there is no authentication requirement, or it was mistakenly assumed authentication would be undertaken by some other system or performed in some previous action
Mark can access resources or services because there is no authentication requirement, or it was mistakenly assumed authentication would be undertaken by some other system or performed in some previous action
OWASP SCP
23,32,34
OWASP ASVS
1.4.5,4.3.1
OWASP AppSensor
CAPEC
-
SAFECODE
14,28
For each entry point, check and test that the correct degree of authentication is required and occurs. Ensure this includes:
Access to remote systems. APIs. Non HTML content (e.g. files, images). Reporting. Any other 'internal' functionality. The key concept for this card is missing authentication. See AT Q for inconsistent authentication and AT K for changing the executing authentication code.
Mappings
OWASP ASVS (4.0): 1.4.5 ,4.3.1
Capec: 115
OWASP SCP: 23,32,34
OWASP Appsensor:
Safecode: 14,28
ASVS (4.0) Cheatsheetseries Index
ASVS V1.4 - Access Control Architectural Requirements
ASVS V4.3 - Other Access Control Considerations
No suitable mappings were found.
