Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a recommendation on the HSTS preload list to resolve #1941 #1952

Merged
merged 2 commits into from
May 9, 2024
Merged

Add a recommendation on the HSTS preload list to resolve #1941 #1952

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a0966bd
Add a recommendation on the HSTS preload list to resolve #1941
tghosth May 6, 2024
8c5a0fb
Clarify wording
tghosth May 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions 5.0/en/0x99-Appendix-X_Recommendations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ The following items are in-scope for ASVS. We don't think they should be made ma
* Create a publicly available security.txt file at the root or .well-known directory of the application that clearly defines a link or e-mail address for people to contact owners about security issues.
* Client-side input validation should be enforced in addition to validation at a trusted service layer as this provides a good opportunity to discover when someone has bypassed client-side controls in an attempt to attack the application.
* Prevent accidentally accessible and sensitive pages from appearing in search engines using a robots.txt file, the X-Robots-Tag response header or a robots html meta tag.
* Use the HSTS preload list so that the use of TLS for the application will be built into the main browsers rather than only relying on the relevant HTTP response header.

## Software Security processes

Expand Down
Loading