05eb0a61_P_Top_Ten_Cheat_Sheet____OWASP__1
[0] A3 Weak authentication and session management [2] Design Only use inbuilt session management Store secondary SSO / framework / custom session identifiers in native session object – do not send as additional headers or cookies Validate user is authenticated Validate role is sufficient to perform this action Validate CSRF token [3] Validate role is sufficient to create, read, update, or delete data Tip: Consider the use of a "governor" to regulate the maximum number of requests per second / minute / hour that this user may perform. For example, a typical banking user should not perform more than ten transactions a minute, and one hundred per second is dangerous and should be blocked. [1] 
Render Validate user is authenticated Validate role is sufficient for this view Set "secure" and "HttpOnly" flags for session cookies Send CSRF token with forms
Difference between revisions of "OWASP Top Ten Cheat Sheet" - OWASP