OWASP / OWASP/ASVS

Clarification: 2.3.1 "same user" " expected sequential step order" "without skipping steps"

Open
#3,300 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

V2 (prev V11)
Dominant language
HTML
Stars
3.6k
Forks
831
Avg merge
7h 55m
Merged PRs (30d)
4

Description

Verify that the application will only process business logic flows for the same
user in the expected sequential step order and without skipping steps.

The modern systems are state driven not step driven. For verifying the parallel actions and concurrent workflows have other requirements under business logic security? as current requirement not covered the mentioned case.

"without skipping steps"
Absolute statement. even if business logic allows it then also it should not be skipped for example partial save.

"only process"
How QA verify this?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the requirement text in the raw .md files under the 5.0 branch, then review the related business-logic security requirements. Clarify how “same user,” sequential order, skipped steps, partial saves, and concurrent workflows should be interpreted and verified, and document the agreed wording or guidance in the associated requirement.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.