Write abuse cases next to user stories

How to do it

An abuse case is a user story told by an attacker or a careless user. "As a shopper, I apply a coupon" gets "As a shopper, I apply the same single-use coupon from two tabs at once". Write it in the same ticket, with the expected safe result. Turn it into an automated test before the feature ships, as Turn every fix into a check does for findings. Use the STRIDE line from the threat file to find cases you would miss.

Examples

JavaScript example

test('abuse case: one single-use coupon redeemed from two tabs at once works once', async () => {
  const results = await Promise.all([redeem(cart, 'WELCOME10'), redeem(cart, 'WELCOME10')]);
  assert.equal(results.filter(r => r.ok).length, 1);
});

Python example

def test_abuse_case_single_use_coupon_from_two_tabs_works_once(client, cart):
    with ThreadPoolExecutor() as pool:
        results = list(pool.map(lambda _: redeem(client, cart, "WELCOME10"), range(2)))
    assert sum(r.ok for r in results) == 1

How to check

A script reads the tickets merged in the last release that carry a sensitive label. Each links at least one abuse case, and each abuse case names a test that exists and passes.

Sources

• OWASP Abuse Case Cheat Sheet

Related rules

• APS-1 Plan attacks before building in Application security
• SEC-7 Turn every fix into a check in Adversarial testing