Standards and frameworks · Software and application security

OWASP ASVS 5.0.0 OWASP Application Security Verification Standard

PublishedFree · 30 May 2025

Summary

The OWASP Foundation standard lists the security requirements a web application or API must meet, which can be verified through testing and code review. Version 5.0 has about 350 requirements in 17 chapters, including encoding and sanitisation, validation and business logic, frontend and API security, file handling, authentication, sessions, authorisation, tokens, OAuth and OpenID Connect, cryptography, secure communication, configuration, data protection, security logging and WebRTC. The requirements are spread over three levels: the first is the minimum for every application, the second is recommended for most cases and the third is for the most critical applications. Developers, architects and testers use it as a checklist, a basis for procurement specifications and a yardstick for security testing.

Reference

OWASP ASVS 5.0.0

Official title

OWASP Application Security Verification Standard

Body

OWASP

Type

Industry requirements

Status

Published

Published

30 May 2025

Edition

5.0.0

Access to the text

Free

Sectors

• Software and application security

Notes

Version 5.0.0 was published on 30 May 2025 and thoroughly reorganises 4.0.3 of 2021: chapters go from 14 to 17 and requirements are renumbered, so references to the previous version need updating. The text is free under a Creative Commons BY-SA 4.0 licence and is also available in machine-readable formats (CSV and JSON) in the project repository.

Last verified

2 November 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)