This repository has been archived by the owner on Apr 9, 2024. It is now read-only.

Bring up to date with base.#1

Open

bonds0097 wants to merge 2672 commits intopraetorian-inc:masterfrom OWASP:master

+122,757-12

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 25, 2024

Move dependency confusion to v10

tghosth
authored and
elarlang
committed
#2164 - move components-up-to-date to V10

Elar Lang
authored and
elarlang
committed
#2088 move dependency pieces to V10

Elar Lang
authored and
elarlang
committed
cleanup out-of-scope texts

Elar Lang
authored and
elarlang
committed
cleanup - too specific reference

Elar Lang
authored and
elarlang
committed

Commits on Oct 27, 2024

Commits on Oct 28, 2024

Updated Glossary to Resolve #2100 (#2200 )

ryarmst
and
tghosth
authored
#2172 - inactivity timeout based on documentated decisions

Elar Lang
authored and
tghosth
committed
#2172 - section text is not aligned with content anymore, remove

Elar Lang
authored and
tghosth
committed
#1610 - no reference, no problem (remove outdated section text)

Elar Lang
authored and
tghosth
committed
Resolve #959 - document requirements for browsers and check them (#2205 )

elarlang
and
Elar Lang
authored

Commits on Oct 31, 2024

Commits on Nov 3, 2024

Resolve #2214 by correcting HTTP header vs HTTP header field (#2217 )

elarlang
and
Elar Lang
authored

Commits on Nov 4, 2024

Resolve #2145 by reviewing problematic malicious code requirements (#2218 )

authored

Commits on Nov 5, 2024

Add forwardsec and omegapoint as tertiary (#2193 )
tghosth
authored
Clarify that 12.2.1 on checks for uploaded files should also cover archives to resolve #1779 (#2221 )
jmanico
authored
Resolves part of #1471 by clarifying req on external code

authored
Resolves part of #1471 by removing duplicate req
ImanSharaf
authored
Resolve #2224 by cleaning up V12 text (#2225 )

jmanico
and
tghosth
authored
Modified 10.4.1 to make it more clear

ImanSharaf
authored and
tghosth
committed
Fixed a small grammar issue

ImanSharaf
authored and
tghosth
committed
Fixed a small grammar issue

ImanSharaf
authored and
tghosth
committed
Resolve #2220 by adding argon2id to section text

jmanico
and
tghosth
authored
#2212 import - take V6 inventory requirements to V1

Elar Lang
authored and
tghosth
committed
#2212 import - V6 control objective

Elar Lang
authored and
tghosth
committed
#2212 import algorithm requirement and extra information

Elar Lang
authored and
tghosth
committed
#2212 import Cipher Algorithms

Elar Lang
authored and
tghosth
committed
#2212 import - Hashing and Hash-based Functions

Elar Lang
authored and
tghosth
committed
#2212 import content

Elar Lang
authored and
tghosth
committed
#2212 import content++

Elar Lang
authored and
tghosth
committed
renumbering

Elar Lang
authored and
tghosth
committed
linter

Elar Lang
authored and
tghosth
committed
Minor wording tweak
tghosth
committed
tag fix for #2223

elarlang
authored and
tghosth
committed
tag fix for #2222 (#2237 )
elarlang
authored
Resolve #1479 by moving most of glossary items out of V2 (#2219 )
tghosth
authored
Fixed small grammar issues

ImanSharaf
authored and
tghosth
committed
Removing extra text from v3
jmanico
authored

Commits on Nov 6, 2024

Delete requirement for unicode text to resolve #2239
tghosth
committed
Resolve #2255 by adding recommendation for 15 char passwords
tghosth
committed
Resolve #2241 by merging mTLS req into the new overall mTLS requirement
tghosth
committed
deduplicate 2.2.2 and 2.7.1 to resolve #1811
tghosth
committed
resolve #2240 by removing history req and making password rotation req positive
tghosth
committed
Resolve #1013 my merging 2.2.7 and 2.3.2 into 2.2.4
tghosth
committed
Resolve #2268 by deleting 2.8.5 notification on multi-factor OTP
tghosth
committed
V2 refresh text (#2263 )
tghosth
committed
corrections

elarlang
authored and
tghosth
committed
Fix whitespace
tghosth
committed
Fix output script
tghosth
committed
Move V1 sections into relevant chapters (#2283 )

ImanSharaf
and
tghosth
authored
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Fixed a minor grammar issue (14.3.5) (#2288 )

ImanSharaf
and
tghosth
authored
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Resolve #1861 by removing different length requirements
tghosth
committed
Resolve #1812 by removing a low impact temp password storage
tghosth
committed
Add push bombing protection to resolve #1415 (#2287 )
tghosth
authored
Update 3.7.1 to resolve 1523 (#2292 )
ryarmst
authored
Move and Modify 4.1.5 to 7.4.5 to resolve #2282 (#2294 )

ryarmst
and
tghosth
authored
Update V3.7 name and description to resolve #2270 (#2295 )

ryarmst
and
tghosth
authored
Resolve #1576 by adding dual approval for very sensitive operations (#2296 )

jmanico
and
tghosth
authored
Move authentication with external services to 14.7 to resolve #2298 (#2299 )
tghosth
authored
Update 3.1.3 to resolve #2253 (#2300 )
ryarmst
authored
Update and move 3.2.2 -> 3.1.4 and resolve 2273 (#2301 )
ryarmst
authored
Update 3.2.4 tag to resolve #2273 (#2303 )
ryarmst
authored
Resolve #2231 by adding a concurrency section (#2302 )
cronchie
authored
Move 3.8.3 to 3.7.2 to resolve #2271 (#2304 )

ryarmst
and
tghosth
authored
Clean up crypto agility requirements (resolve #2293 and resolve #1544 )

danielcuthbert
and
tghosth
authored
Move password storage to v6 and clarify argon2ID and parameters to resolve #2238 (#2276 )

danielcuthbert
and
tghosth
authored
cleanup, closes #2181
elarlang
committed
remove cheat sheet content
elarlang
committed
V51 chapter text update, closes #2036 , #2037
elarlang
committed
make 5.2.12 positive requirement, closes #1964
elarlang
committed
update 51.4.2, #2182
elarlang
committed
whitespace and tag corrections

Elar Lang
authored and
tghosth
committed
Fix spelling publically -> publicly

Gabriel Corona
authored and
tghosth
committed

Commits on Nov 7, 2024

Resolve #2150 by adding about per-IDP user ID namespacing (#2311 )

authored
Removed all technical details into Appendix V, amended 6.5.4 to include tokens too

danielcuthbert
authored and
tghosth
committed
added better explanations for dev/urandom and getentropy()

danielcuthbert
authored and
tghosth
committed
Added 6.4.3 and 6.4.4 on rotation of secrets and principle of least priv

danielcuthbert
authored and
tghosth
committed
Fixes for #2245 and #2248

danielcuthbert
authored and
tghosth
committed
Fix for #2247

danielcuthbert
authored and
tghosth
committed
Fix for #2228

danielcuthbert
authored and
tghosth
committed
deleted 6.2.6 dup of 6.5.3

danielcuthbert
authored and
tghosth
committed
Tweaks to the updated requirements
tghosth
committed
linting
tghosth
committed
Change GUID to UUID
tghosth
committed
Clean extra text
tghosth
committed
Added service mesh and more details to 9.3.3 to resolve #2266 (#2316 )

ImanSharaf
and
tghosth
authored
Added SAML requirements to resolve #1738 (#2317 )

ImanSharaf
and
tghosth
authored
reorg for #2139
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Update 0x16-V8-Data-Protection.md

jmanico
authored and
elarlang
committed
Merge 3.6.2 into 3.6.1 and generalize - resolve #1190 (#2320 )
ryarmst
authored
Clarify 5.5.3 to resolve #2297 (#2323 )
tghosth
authored
rewording anti-automation, change levels #2269 (#2324 )

elarlang
and
jmanico
authored
Resolve #1763 by splitting 2.2.1 (#2319 )
tghosth
authored
Fix v5 headings to resolve #2206 (#2326 )
tghosth
authored
Update 0x12-V4-Access-Control.md

jmanico
authored and
elarlang
committed
Align security decision reqs and impl reqs to resolve #2331 (#2333 )

jmanico
and
tghosth
authored
Remove NIST references to a different file to resolve # 2277 (#2332 )
tghosth
authored
Added 1.3.3 to resolve #2102 (#2336 )
ryarmst
authored
Generalize IDP requirement to resolve #2325 (#2335 )
tghosth
authored
Clarify 10.3.1 and move to L3 to resolve #2226 (#2339 )
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Minor wording error
tghosth
committed
Merged 13.3 into 13.2 to resolve #2260 (#2338 )

ImanSharaf
and
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Adding use-after-free to resolve #2329 (#2343 )

cronchie
and
tghosth
authored
Make 14.1.2 L3 to resolve #2280 (#2341 )

ImanSharaf
and
tghosth
authored
Clarify when PQC algorithms should be used to resolve #2251 (#2345 )
tghosth
authored
Remove 9.4.4 as out of scope to resolve #2312 (#2347 )
tghosth
authored
Trim data protection requirements to resolve #2330 (#2349 )
tghosth
authored
Rephrased the section to make it shorter (#2348 )
ImanSharaf
authored
Rephrased the section to make it shorter (#2346 )

ImanSharaf
and
tghosth
authored
Revert the levels part of this PR (#2351 )
tghosth
authored
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
Update 0x50-V50-Web-Frontend-Security.md

jmanico
authored and
elarlang
committed
remove 8.3.9 (v4.0.3-10.2.2) , closes #2350 (#2352 )
elarlang
authored
Asvs corrections vol2 (#2353 )

elarlang
and
Elar Lang
authored

Commits on Nov 8, 2024

Commits on Nov 10, 2024

who stole the table header?

elarlang
authored and
tghosth
committed

Commits on Nov 11, 2024

fix for issue #2366

danielcuthbert
authored and
elarlang
committed
tag
elarlang
committed

Commits on Nov 14, 2024

aud restriction for access token, closes #2182 (#2369 )
elarlang
authored
#2185 - update token time-window validation

Elar Lang
authored and
tghosth
committed
#2368 - move and update requirement for user-consent-for-a-session

Elar Lang
authored and
tghosth
committed
#2184 - update token integrity check

Elar Lang
authored and
tghosth
committed
rm '

elarlang
authored and
tghosth
committed
Add 3.5.7 to resolve 2362

ryarmst
authored and
elarlang
committed

Commits on Nov 16, 2024

#2111 - correct references between 5.3.1 and 51.2.14

Elar Lang
authored and
elarlang
committed

Commits on Nov 18, 2024

added encrypted client hello to 9.4 to resolve #2358 (#2382 )
danielcuthbert
authored
#2151 - authorization_details integrity

Elar Lang
authored and
elarlang
committed
#2182 - audience validation requirements for OAuth resource server (51.4.2) and OIDC client (51.5.4)

Elar Lang
authored and
elarlang
committed
Tweak wording

tghosth
authored and
elarlang
committed

Commits on Nov 19, 2024

Added content for #2314

danielcuthbert
authored and
tghosth
committed
typo in rfc

danielcuthbert
authored and
tghosth
committed
removed cto ref

danielcuthbert
authored and
tghosth
committed
amdned 6.9.1 to be more reflective of PQC status quo

danielcuthbert
authored and
tghosth
committed
fixed linting issues

danielcuthbert
authored and
tghosth
committed
tag fixes

elarlang
authored and
tghosth
committed
addressing PR comments

danielcuthbert
authored and
tghosth
committed
added keywrapping explanation to appendix

danielcuthbert
authored and
tghosth
committed
added NIST PQC FIPS guidelines to appendix

danielcuthbert
authored and
tghosth
committed
ficed 6.6.5 to read more clearly

danielcuthbert
authored and
tghosth
committed
Minor tweak
tghosth
committed
linting
tghosth
committed

Commits on Nov 20, 2024

Resolve #2309 with requirement about validation of client mTLS certificates (#2388 )

authored
Move secret management to configuration chapter to resolve #2130 (#2392 )
tghosth
authored
Clarify 6.7.1
tghosth
committed
Clarify 6.6.5
tghosth
committed
Try and slightly clarify scope of chapters to resolve #2375
tghosth
committed
Crypto crypto inv into 1.6.4 to resolve #685 and merge secrets mgt reqs to resolve #2376
tghosth
authored
V6 corrections

elarlang
authored and
tghosth
committed
#2363 - tokens, check audience

Elar Lang
authored and
tghosth
committed
#2379 - tokens, check type (moved and modified requirement from OAuth chapter)

Elar Lang
authored and
tghosth
committed
#2182 - correction for OAuth specifi 'aud' check

Elar Lang
authored and
tghosth
committed
#2182 - update 51.4.2 - OAuth specific audience check

Elar Lang
authored and
tghosth
committed
#2363 - wording for general token audience requirement

Elar Lang
authored and
tghosth
committed

Commits on Nov 21, 2024

V51, Add requirements about user consent (#2397 )

authored

Commits on Nov 22, 2024

Remove duplicate req to resolve #2402 (#2404 )

danielcuthbert
and
tghosth
authored
Move default accounts to 14.1 to resolve #2394 (#2403 )
tghosth
authored
V5, Remove restrictions on non mentioned algorithms

Gabriel Corona
authored and
tghosth
committed
Crypto appendix: add Salsa20, XChaCha20, BLAKE2, BLAKE3

Gabriel Corona
authored and
tghosth
committed
Crypto appendix: allow HMAC-SHA-1 (#2399 )

authored

Commits on Nov 24, 2024

Delete 3.5.6 and replace with the old 3.5.9 to resolve #1967 (#2405 )
tghosth
authored

Commits on Nov 28, 2024

#2401 - separate section for OAuth consent requirements

elarlang
authored and
tghosth
committed
#2401 - new requirement for managing consents, md table fix

elarlang
authored and
tghosth
committed
numeration fix

elarlang
authored and
tghosth
committed
#2417 - reorder and openid provider chapter title fix

elarlang
authored and
tghosth
committed

Commits on Nov 29, 2024

move cookie section from V3 session management to V50 front-end security (#2418 )

elarlang
and
Elar Lang
authored
Update 0x19-V11-BusLogic.md

jmanico
authored and
elarlang
committed

Commits on Dec 2, 2024

Remove spurious asterisk

Gabriel Corona
authored and
tghosth
committed
Move self-contained token requirements to a dedicated chapter to resolve #2384 (#2429 )
tghosth
authored

Commits on Dec 3, 2024

Fix 'in line' typo

Gabriel Corona
authored and
tghosth
committed

Commits on Dec 6, 2024

#2419 - cookie secure attribute and __Secure- prefix

Elar Lang
authored and
elarlang
committed
#2420 - cookie httponly attribute

Elar Lang
authored and
elarlang
committed
#2421 - cookie samesite attribute

Elar Lang
authored and
elarlang
committed
#2422 - cookie __Host- prefix

Elar Lang
authored and
elarlang
committed
Remove password length denial of service to resolve #1923 (again) (#2438 )
tghosth
authored
Clarify token terminology throughout to resolve #2414 (#2434 )
tghosth
authored
Clarify 9.4.1 about foward secrecy to resolve #2215 (#2439 )
tghosth
authored
eol win > unix

Elar Lang
authored and
elarlang
committed

Commits on Dec 7, 2024

rm reference
elarlang
committed
Fix presentation issues with CCM-8 notes

Gabriel Corona
authored and
tghosth
committed
More precise naming for RSA signature schemes

Gabriel Corona
authored and
tghosth
committed

Commits on Dec 9, 2024

Clarify wording to resolve #2416 (#2444 )
tghosth
authored

Commits on Dec 10, 2024

Commits on Dec 11, 2024

#2428 - should > must, L1 > L2

elarlang
authored and
tghosth
committed
mapping fixes, resolve #2454

Elar Lang
authored and
tghosth
committed

Commits on Dec 12, 2024

Adding clarification on crypto discovery tools to resolve #2395 (#2450 )
tghosth
authored

Commits on Dec 15, 2024

Clarify 6.2.9 wording to resolve #2461

tghosth
authored and
elarlang
committed

Commits on Dec 16, 2024

Commits on Dec 17, 2024

Fixed a number of typos

Robert Bengtsson
authored and
elarlang
committed
Start improving front text (#2365 )
tghosth
authored
Update V3 chapter/section text for 2442 (#2459 )

authored

Commits on Dec 19, 2024