ESAPI Charter

Jump to: navigation, search

ESAPI Charter

The goal of the OWASP ESAPI Project is to ensure:

  strong simple security controls are available
  to every developer in every environment
Strong controls do not contain vulnerabilities and provide complete protection against the threats they were designed for.
Controls that are not easy to use will most likely be misused by developers and create vulnerability
Controls are available if they are present in the developer's environment in a way that makes them easy and obvious to use. The goal of the ESAPI project is not to replace good security controls that are already available in programming environments. Nor is it our goal to make developers access security controls directly. It's even better if the controls are already present or are integrated into a framework in a way that is invisible or automatic to developers.
Every Developer
It is difficult to imagine a developer that does not need a set of basic security controls in their environment, from students to senior architects.
Every Environment
Our initial target is server-side web environments, then we plan to extend to both web service environments and client side frameworks, and eventually other non-web programming environments.


Obviously we cannot provide security controls in every environment all at once. Therefore, we've decided to focus on several key software environments that are widely used and we will expand the list over time. Here is our current scorecard:

Security Area Java EE .NET PHP Classic ASP Haskell Cold Fusion
Authentication © ©        
Session Management ©          
Access Control ©          
Input Validation ©          
Canonicalization ©          
Output Encoding ©          
Security Exceptions ©          
Security Logging ©          
Intrusion Detection ©          
Encryption ©          
Randomness ©          
HTTP Protections ©