appsec-requirements-example.sdd

Spec: Example Application Behavior

Purpose:
  Translate the observable, mandatory application behavior from appsec-requirements-example.yaml into one SpecDD root specification while leaving implementation-only secure-coding guidance in the YAML catalog.

Must:
  # Category: Authentication & Access Control
  AC-003: Login, registration, credential recovery, verification, token issuance, and other abuse-prone endpoints MUST apply bounded request sizes and rate limits by both account or identifier and client source using a control effective across application instances.
  AC-004: Workforce and privileged users MUST authenticate through the organization-managed identity provider using OIDC authorization code with PKCE or SAML, and privileged access MUST require phishing-resistant MFA where supported. A parallel local password path requires a documented operational need.
  AC-006: Every request for a protected object MUST authorize the authenticated identity against that object's owner, tenant, state, and requested action. User-supplied identifiers and token possession alone MUST NOT grant access.
  # Category: Error Handling & Security Events
  EH-002: Client error responses MUST NOT expose stack traces, query text, internal paths, credentials, tokens, or raw exceptions. Diagnostic details MAY be recorded only in access-controlled server-side logs after sensitive values are removed.
  # Category: Web & Frontend Security
  WEB-001: Applications that use cookie-based or other ambient browser credentials MUST reject forged cross-site state-changing requests with a framework CSRF control, a session-bound token, or a validated same-origin signal. SameSite cookies provide defense in depth and state-changing actions MUST NOT use HTTP GET.

Scenario: repeated authentication attempts are throttled
  Given repeated authentication attempts target one account from changing client sources
  When either the account or a client source exceeds its permitted rate
  Then the application throttles the attempts across every application instance

Scenario: privileged workforce user starts a session
  Given a privileged workforce user has no authenticated session
  When the user signs in
  Then the application uses the organization-managed identity provider
  And privileged access requires phishing-resistant MFA where supported

Scenario: user requests a resource from another tenant
  Given an authenticated user supplies the identifier of a resource owned by another tenant
  When the user requests that resource by its identifier
  Then the application denies access regardless of token possession or identifier validity

Scenario: request processing fails unexpectedly
  When request processing raises an unexpected error
  Then the application returns a generic error response without internal details
  And any retained diagnostic is access-controlled and contains no sensitive values

Scenario: cross-site state-changing request
  Given a user has an authenticated browser session
  When another site submits a state-changing request without a valid token or same-origin signal
  Then the application rejects the request