Downloaded 134 times
![Securing Methods <global-method-security secured-annotations="enabled"/> @Secured("IS_AUTHENTICATED_ANONYMOUSLY") public Account readAccount(Long id); @Secured("IS_AUTHENTICATED_ANONYMOUSLY") public Account[] findAccounts(); @Secured("ROLE_TELLER") public Account post(Account account, double amount); <global-method-security jsr250-annotations="enabled"/> © 2011 Raible Designs](https://image.slidesharecdn.com/javawebapplicationsecurityjazoon2011-110623122132-phpapp01/75/Java-Web-Application-Security-Jazoon-2011-15-2048.jpg)
![Securing Methods 3.0 <global-method-security pre-post-annotations="enabled"/> @PreAuthorize("isAnonymous()") public Account readAccount(Long id); @PreAuthorize("isAnonymous()") public Account[] findAccounts(); @PreAuthorize("hasAuthority('ROLE_TELLER')") public Account post(Account account, double amount); © 2011 Raible Designs](https://image.slidesharecdn.com/javawebapplicationsecurityjazoon2011-110623122132-phpapp01/75/Java-Web-Application-Security-Jazoon-2011-16-2048.jpg)
![Apache Shiro Filter defined in web.xml shiro.ini loaded from classpath [main], [urls], [roles] Cryptography Session Management © 2011 Raible Designs](https://image.slidesharecdn.com/javawebapplicationsecurityjazoon2011-110623122132-phpapp01/75/Java-Web-Application-Security-Jazoon-2011-18-2048.jpg)
Uploaded byMatt Raible
Java Web Application Security - Jazoon 2011
The document discusses Java web application security, outlining agenda topics including security development, penetration testing, and protecting applications. It explores frameworks like Java EE 6, Spring Security, and Apache Shiro, detailing their features and limitations. Additionally, it emphasizes the importance of integrating security in the development process rather than applying patches afterward.
Java Web Application Security - Jazoon 2011
- 1. Java Web ApplicationSecurity Develop. Penetrate. Protect. Relax. Matt Raible http://raibledesigns.com @mraible Images by Stuck in Customs - http://www.flickr.com/photos/stuckincustoms © 2011 Raible Designs
- 2. Introductions Your experiencewith web development? Your experience with implementing security? Have you used Java EE 6, Spring Security or Apache Shiro? What do you want to get from this talk? © 2011 Raible Designs
- 3. Blogger on Father, Skier, raibledesigns.com Cyclist Founder of AppFuse Web Framework Connoisseur Who is Matt Raible? © 2011 Raible Designs
- 4. Why am Ihere? Purpose To learn more about Java webapp security and transform myself into a security expert. Goals Show how to implement Java webapp security. Show how to penetrate a Java webapp. Show how to fix vulnerabilities. © 2011 Raible Designs
- 5. Session Agenda Security Development Java EE 6, Spring Security, Apache Shiro SSL and Testing Verifying Security OWASP Top 10 & Zed Attack Proxy Commercial Tools and Services Conclusion Develop Penetrate Protect Relax © 2011 Raible Designs
- 6. Develop © 2011 Raible Designs
- 7. Dynamic Language Support? Ifit deploys on Tomcat, it has a web.xml. Grails JRuby on Rails Lift Play! Framework © 2011 Raible Designs
- 8. Java EE 6 Securityconstraints defined in web.xml web resource collection - URLs and methods authorization constraints - role names user data constraint - HTTP or HTTPS User Realm defined by App Server Declarative or Programmatic Authentication Annotations Support © 2011 Raible Designs
- 9. Java EE 6Demo http://www.youtube.com/watch?v=8bXBGU7uo4o © 2011 Raible Designs
- 10. Servlet 3.0 HttpServletRequest authenticate(response) login(user, pass) logout() getRemoteUser() isUserInRole(name) © 2011 Raible Designs
- 11. Servlet 3.0 andJSR 250 Annotations @ServletSecurity @HttpMethodConstraint @HttpConstraint @RolesAllowed @PermitAll @DenyAll © 2011 Raible Designs
- 12. Java EE SecurityLimitations No error messages for failed logins No Remember Me Container has to be configured Doesn’t support regular expressions for URLs © 2011 Raible Designs
- 13. Spring Security Filterdefined in web.xml Separate security context file loaded by Spring Defines URLs, Roles and Authentication Providers Defines UserService (provided or custom) Password Encoding Remember Me © 2011 Raible Designs
- 14. Spring Security Demo http://www.youtube.com/watch?v=poc5dyImbig © 2011 Raible Designs
- 15. Securing Methods <global-method-security secured-annotations="enabled"/> @Secured("IS_AUTHENTICATED_ANONYMOUSLY") public Account readAccount(Long id); @Secured("IS_AUTHENTICATED_ANONYMOUSLY") public Account[] findAccounts(); @Secured("ROLE_TELLER") public Account post(Account account, double amount); <global-method-security jsr250-annotations="enabled"/> © 2011 Raible Designs
- 16. Securing Methods 3.0 <global-method-securitypre-post-annotations="enabled"/> @PreAuthorize("isAnonymous()") public Account readAccount(Long id); @PreAuthorize("isAnonymous()") public Account[] findAccounts(); @PreAuthorize("hasAuthority('ROLE_TELLER')") public Account post(Account account, double amount); © 2011 Raible Designs
- 17. Spring Security Limitations Authentication mechanism in WAR Securing methods only works on Spring beans My remember me example doesn’t work © 2011 Raible Designs
- 18. Apache Shiro Filter definedin web.xml shiro.ini loaded from classpath [main], [urls], [roles] Cryptography Session Management © 2011 Raible Designs
- 19. Apache Shiro Demo http://www.youtube.com/watch?v=YJByiDvOhsc © 2011 Raible Designs
- 20. Apache Shiro Limitations LimitedDocumentation Getting Roles via LDAP not supported No out-of-box support for Kerberos REST Support needs work © 2011 Raible Designs
- 21. Testing with SSL Cargodoesn’t support http and https at same time Jetty and Tomcat plugins work for both Pass javax.net.ssl.trustStore & javax.net.ssl.trustStorePassword to maven-failsafe-plugin as <systemPropertyVariables> © 2011 Raible Designs
- 22.
- 23. Securing a RESTAPI Use Basic or Form Authentication Use Developer Keys Use OAuth © 2011 Raible Designs
- 24. OAuth © 2011 Raible Designs
- 25. REST Security andOAuth Demo http://raibledesigns.com/rd/entry/implementing_oauth_with_gwt http://raibledesigns.com/rd/entry/grails_oauth_and_linkedin_apis © 2011 Raible Designs
- 26. REST Security Resources ImplementingREST Authentication http://www.objectpartners.com/2011/06/16/ implementing-rest-authentication/ OAuth2’s “Client Credentials” API Key Grant Type http://stackoverflow.com/questions/6190381/how- to-keep-the-client-credentials-confidential-while- using-oauth2s-resource-ow (http://bit.ly/k5LqsH) Thanks to @kdonald for the link! © 2011 Raible Designs
- 27. Penetrate OWASP Testing Guideand Code Review Guide OWASP Top 10 OWASP Zed Attack Proxy Burp Suite OWASP WebGoat © 2011 Raible Designs
- 28. OWASP The Open WebApplication Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. At OWASP you’ll find free and open ... Application security tools, complete books, standard security controls and libraries, cutting edge research http://www.owasp.org © 2011 Raible Designs
- 29.
- 30. 7 Security (Mis) Configurationsin web.xml 1. Error pages not configured 2. Authentication & Authorization Bypass 3. SSL Not Configured 4. Not Using the Secure Flag http://software-security.sans.org/blog/2010/08/11/security-misconfigurations-java-webxml-files © 2011 Raible Designs
- 31. 7 Security (Mis)Configurations 5.Not Using the HttpOnly Flag 6. Using URL Parameters for Session Tracking 7. Not Setting a Session Timeout http://software-security.sans.org/blog/2010/08/11/security-misconfigurations-java-webxml-files © 2011 Raible Designs
- 32. Protecting Ajax Login <session-config> <session-timeout>15</session-timeout> <cookie-config> <http-only>true</http-only> <secure>true</secure> </cookie-config> <tracking-mode>COOKIE</tracking-mode> </session-config> <form action="${ctx}/j_security_check" id="loginForm" method="post" autocomplete="off"> © 2011 Raible Designs
- 33. OWASP Top 10for 2010 1. Injection 2. Cross-Site Scripting (XSS) 3. Broken Authentication and Session Management 4. Insecure Direct Object References 5. Cross-Site Request Forgery (CSRF) © 2011 Raible Designs
- 34. OWASP Top 10for 2010 6. Security Misconfiguration 7. Insecure Cryptographic Storage 8. Failure to Restrict URL Access 9. Insufficient Transport Layer Protection 10.Unvalidated Redirects and Forwards © 2011 Raible Designs
- 35. Protect Firewalls IDS and IDPs Audits PenetrationTests Code Reviews with Static Analysis Tools © 2011 Raible Designs
- 36. Firewalls Stateless Firewalls Stateful Firewalls Invented by Nir Zuk at Check Point in the mid-90s Web App Firewalls Inspired by the 1996 PHF CGI exploit WAF Market $234m in 2010 © 2011 Raible Designs
- 37. Gartner on Firewalls © 2011 Raible Designs
- 38. Relax Web App Firewalls:Imperva, F5, Breach Open Source: WebNight and ModSecurity Stateful Firewalls: Juniper, Check Point, Palo Alto IDP/IDS: Sourcefire, TippingPoint Open Source: Snort Audits: ENY, PWC, Grant Thornton Pen Testing: WhiteHat, Trustwave, Electric Alchemy Open Source: OWASP ZAP Static Analysis: Fortify, Veracode © 2011 Raible Designs
- 39. Remember... “Security is aquality, and as all other quality, it is important that we build it into our apps while we are developing them, not patching it on afterwards like many people do.” -- Erlend Oftedal From: http://bit.ly/mjufjR © 2011 Raible Designs
- 40. Action! Use OWASPand Open Source Security Frameworks Don’t be afraid to contribute! Follow the Security Street Fighter Blog http://software-security.sans.org/blog Use OWASP ZAP to pentest your apps Don’t be afraid of security! © 2011 Raible Designs
- 41. Questions? Contact Information http://raibledesigns.com @mraible My Presentations http://slideshare.net/mraible © 2011 Raible Designs