05eb0a61_P_Top_Ten_Cheat_Sheet____OWASP__1
[0] A7 Failure to Restrict URL access [2] Validate user is authenticated Validate role is sufficient to perform secured action Validate CSRF token Tip: It's impossible to control access to secured resources that the web application server does not directly serve. Therefore, PDF reports or similar should be served by the web application server using binary octet streaming. Tip: Assume attackers will learn where "hidden" directories and "random" filenames are, so do not store these files in the web root, even if they are not directly linked. [3] Validate role is sufficient to create, read, update, or delete data [1] 
Design Ensure all non-web data is outside the web root (logs, configuration, etc) Use octet byte streaming instead of providing access to real files such as PDFs or CSVs or similar Ensure every page requires a role, even if it is "guest" Pre-render Validate user is authenticated Validate role is sufficient to view secured URL Render Send CSRF token
Difference between revisions of "OWASP Top Ten Cheat Sheet" - OWASP