Our project focusses on client-side only, intentionally not tackling things covered by ASVS anymore.
This should be explained clearly in a general section to avoid confusion and to make it clear where the split in responsibility is. This mostly comes up with things like authentication and access control:
- OAUTH Flow:
- MAS: Which webview to use
- ASVS: Which OAUTH config
- MFA
- Client: Support for autofil
- ASVS: Verifying if backend requires MFA and properly verifies it
In this last example, whether or not the app supports MFA is irrelevant because it needs to be enforced on the backend. We can't say 'the app has this functionality, so it passes MFA requirements' because the backend might not verify the code and you effectively don't have MFA. So you can't make any useful statements based purely on the mobile client.
Our project focusses on client-side only, intentionally not tackling things covered by ASVS anymore.
This should be explained clearly in a general section to avoid confusion and to make it clear where the split in responsibility is. This mostly comes up with things like authentication and access control:
In this last example, whether or not the app supports MFA is irrelevant because it needs to be enforced on the backend. We can't say 'the app has this functionality, so it passes MFA requirements' because the backend might not verify the code and you effectively don't have MFA. So you can't make any useful statements based purely on the mobile client.