OWASP - User contributions [en]

Category:OWASP Enterprise Security API

2008-10-22T14:45:40Z

Dhadley519: /* Using the ESAPI */ I updated to link to the javadocs to resolve to what is currently correct. It was a broken link.

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP_ESAPI_Top_Ten_650x488.png

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

Category:OWASP Enterprise Security API

2008-10-22T14:44:19Z

Dhadley519: /* Resources */ I updated the link to the javadocs to resolve to the current actual location. It was broken.

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP_ESAPI_Top_Ten_650x488.png

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__