V13.4.3 Directory listings disabled
Requirement 13.4.3 applies at Level 2. Verify that web servers do not expose directory listings to clients unless explicitly intended.
asvs/v13-configuration
23 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
V13.1.1 Communication needs documentation
Requirement 13.1.1 applies at Level 2. Verify that all communication needs for the application are documented. This must include external services which the application relies upon and cases where an end user might be able to provide an external location to which the application will then connect.
V13.1.2 Concurrent connections and limits documentation
Requirement 13.1.2 applies at Level 3. Verify that for each service the application uses, the documentation defines the maximum number of concurrent connections (e.g., connection pool limits) and how the application behaves when that limit is reached, including any fallback or recovery mechanisms, to prevent denial of service conditions.
V13.1.3 Resource management strategies documentation
Requirement 13.1.3 applies at Level 3. Verify that the application documentation defines resource-management strategies for every external system or service it uses (e.g., databases, file handles, threads, HTTP connections). This should include resource-release procedures, timeout settings, failure handling, and where retry logic is implemented, specifying retry limits, delays, and back-off algorithms. For synchronous HTTP request-response operations it should mandate short timeouts and either disable retries or strictly limit retries to prevent cascading delays and resource exhaustion.
V13.1.4 Secrets rotation schedule documentation
Requirement 13.1.4 applies at Level 3. Verify that the application's documentation defines the secrets that are critical for the security of the application and a schedule for rotating them, based on the organization's threat model and business requirements.
V13.2.1 Backend component authentication
Requirement 13.2.1 applies at Level 2. Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.
V13.2.2 Backend component least privilege
Requirement 13.2.2 applies at Level 2. Verify that communications between backend application components, including local or operating system services, APIs, middleware, and data layers, are performed with accounts assigned the least necessary privileges.
V13.2.3 Non-default service credentials
Requirement 13.2.3 applies at Level 2. Verify that if a credential has to be used for service authentication, the credential being used by the consumer is not a default credential (e.g., root/root or admin/admin).
V13.2.4 External resources allowlist
Requirement 13.2.4 applies at Level 2. Verify that an allowlist is used to define the external resources or systems with which the application is permitted to communicate (e.g., for outbound requests, data loads, or file access). This allowlist can be implemented at the application layer, web server, firewall, or a combination of different layers.
V13.2.5 Web/application server resource allowlist
Requirement 13.2.5 applies at Level 2. Verify that the web or application server is configured with an allowlist of resources or systems to which the server can send requests or load data or files from.
V13.2.6 Separate service connection configuration
Requirement 13.2.6 applies at Level 3. Verify that where the application connects to separate services, it follows the documented configuration for each connection, such as maximum parallel connections, behavior when maximum allowed connections is reached, connection timeouts, and retry strategies.
V13.3.1 Secrets management solution
Requirement 13.3.1 applies at Level 2. Verify that a secrets management solution, such as a key vault, is used to securely create, store, control access to, and destroy backend secrets. These could include passwords, key material, integrations with databases and third-party systems, keys and seeds for time-based tokens, other internal secrets, and API keys. Secrets must not be included in application source code or included in build artifacts. For an L3 application, this must involve a hardware-backed solution such as an HSM.
V13.3.2 Secret asset access least privilege
Requirement 13.3.2 applies at Level 2. Verify that access to secret assets adheres to the principle of least privilege.
V13.3.3 Isolated security module for cryptographic operations
Requirement 13.3.3 applies at Level 3. Verify that all cryptographic operations are performed using an isolated security module (such as a vault or hardware security module) to securely manage and protect key material from exposure outside of the security module.
V13.3.4 Secret expiration and rotation
Requirement 13.3.4 applies at Level 3. Verify that secrets are configured to expire and be rotated based on the application's documentation.
V13.4.1 Source control metadata removal
Requirement 13.4.1 applies at Level 1. Verify that the application is deployed either without any source control metadata, including the .git or .svn folders, or in a way that these folders are inaccessible both externally and to the application itself.
V13.4.2 Debug modes disabled in production
Requirement 13.4.2 applies at Level 2. Verify that debug modes are disabled for all components in production environments to prevent exposure of debugging features and information leakage.
V13.4.4 HTTP TRACE method disabled
Requirement 13.4.4 applies at Level 2. Verify that using the HTTP TRACE method is not supported in production environments, to avoid potential information leakage.
V13.4.5 Documentation and monitoring endpoints not exposed
Requirement 13.4.5 applies at Level 2. Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.
V13.4.6 Backend component version information not exposed
Requirement 13.4.6 applies at Level 3. Verify that the application does not expose detailed version information of backend components.
V13.4.7 Web tier file extension filtering
Requirement 13.4.7 applies at Level 3. Verify that the web tier is configured to only serve files with specific file extensions to prevent unintentional information, configuration, and source code leakage.
Configuration drift detection and response process
Verify that mechanisms are in place to detect and respond to configuration drift in deployed environments. This may include using immutable infrastructure, automated redeployment from a secure baseline, or drift detection tools that compare current state against approved configurations. This was removed from ASVS 5.0 but remains a recommended process.
Third-party configuration hardening process
Verify that configuration hardening is performed on all third-party products, libraries, frameworks, and services as per their individual recommendations. This was removed from ASVS 5.0 but remains a recommended process.