ICS35.240 L60 团体标准 组装式应用开发平台第2部分：安全要 求和测试方法 ComposableApplicationsDevelopmentPlatform PART2:SecurityRequirementsandTestingMethodsT/ISC0054—2024 2024-9-3发布 2024-10-3实施 中国互联网协会发布 全国团体标准信息平台 全国团体标准信息平台 IT/ISC0054—2024 目次 目次.................................................................................................................................................................I 前言...............................................................................................................................................................III 1范围......................................................................................................................................................................4 2规范性引用文件.................................................................................................................................................4 3术语、定义和缩略语TBD................................................................................................................................4 3.1术语定义..........................................................................................................................................................4 3.1.1应用程序接口ApplicationProgrammingInterface.....................................................................................4 3.1.2会话Cookie...................................................................................................................................................4 3.1.3Secure属性....................................................................................................................................................4 3.1.4Domain属性..................................................................................................................................................4 3.1.5Path属性........................................................................................................................................................4 3.1.6HttpOnly........................................................................................................................................................5 3.1.7Session...........................................................................................................................................................5 3.1.8Token..............................................................................................................................................................5 3.1.9敏感数据.......................................................................................................................................................5 3.2缩略语...............................................................................................................................................................5 4安全技术要求.....................................................................................................................................................5 4.1供应链安全......................................................................................................................................................5 4.2代码安全..........................................................................................................................................................5 4.3认证安全..........................................................................................................................................................5 4.3.1身份鉴别.......................................................................................................................................................6 4.3.2登录策略.......................................................................................................................................................6 4.3.3数据审计.......................................................................................................................................................6 4.3.4认证权限..................................................................