Java Security Frameworks - Revision history

Jmanico at 17:05, 22 February 2016

2016-02-22T17:05:22Z

Jmanico at 17:05, 22 February 2016

2016-02-22T17:05:00Z

Jmanico: Redirected page to Category:Java

2016-02-21T01:21:51Z

Redirected page to Category:Java

Jmanico: Redirected page to Category:Java#tab=Related 3rd Party Projects

2016-02-21T01:20:11Z

Redirected page to Category:Java#tab=Related 3rd Party Projects

Jmanico: /* Logging */

2016-02-18T06:03:33Z

‎Logging

Jmanico: /* Validation */

2016-02-18T06:02:58Z

‎Validation

Jmanico: ok lets get a bit more straight up here

2016-02-18T05:58:07Z

ok lets get a bit more straight up here

Andifalk: Changed description for spring security framework

2016-01-01T16:34:23Z

Changed description for spring security framework

Andifalk: Added spring security as enterprise java security framework

2016-01-01T16:23:24Z

Added spring security as enterprise java security framework

Jmanico: /* Additional Java Security Libraries */

2015-03-15T19:39:28Z

‎Additional Java Security Libraries

← Older revision		Revision as of 17:05, 22 February 2016
Line 1:		Line 1:
−	~~#REDIRECT [~~https://www.owasp.org/index.php/Category:Java#tab=Related_3rd_Party_Projects]	+	This page has been moved to https://www.owasp.org/index.php/Category:Java#tab=Related_3rd_Party_Projects.

← Older revision		Revision as of 17:05, 22 February 2016
Line 1:		Line 1:
−	#REDIRECT [[Category:Java]]	+	#REDIRECT [https://www.owasp.org/index.php/Category:Java#tab=Related_3rd_Party_Projects]

← Older revision		Revision as of 01:21, 21 February 2016
Line 1:		Line 1:
−	#REDIRECT [[Category:Java~~#tab=Related_3rd_Party_Projects~~]]	+	#REDIRECT [[Category:Java]]

← Older revision		Revision as of 01:20, 21 February 2016
Line 1:		Line 1:
−	A list of third party (i.e. not part of Java SE or EE) security frameworks. This page contains a list of Java security libraries and frameworks and indicates which security features each library supports.	+	#REDIRECT [[Category:Java#tab=Related_3rd_Party_Projects]]
−
−	~~==Enterprise==~~
−	* [http://shiro.apache.org/ Apache Shiro] is a Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
−	* [http://projects.spring.io/spring-security/ Spring Security] provides comprehensive security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery. There is a particular emphasis on supporting projects built using the Spring Framework, but it is a powerful security solution for standard Java EE applications as well.
−	* [[ESAPI\|OWASP Enterprise Security API]] a new OWASP project to provide all essential security services under one roof.
−	* [http://www.hdiv.org/ HDIV] A web application security framework that provides a number of functions.
−
−	~~== Access Control (Authentication and Authorization) ==~~
−	* [http://sourceforge.net/projects/jguard jGuard] - jGuard is written in Java. Its goal is to provide a security framework based on JAAS (Java Authentication and Authorization Security). The framework is written for web and standalone applications, to easily provide solutions for access control problems.
−	* [http://oaccframework.org/ OACC] - OACC is an application security framework for Java designed for fine grained (object level) access control. OACC uses the abstraction of a ''resource'' for the application objects being secured. This key abstraction enables OACC to provide a rich API that includes grant, revoke and query capabilities for storing and managing the application's security relationships.
−
−	~~== Encryption ==~~
−	* [https://github.com/google/keyczar Keyczar] is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys.
−	* [http:~~//www.bouncycastle.org/ Bouncycastle] - Lightweight~~ Java ~~cryptography API <i>provider</i>.~~
−	* [http://www.jasypt.org/ Jasypt] - Jasypt is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.
−
−	== ~~Cross Site Scripting (XSS) ==~~
−	* [https://www.owasp.org/index.php/OWASP_Java_Encoder_Project OWASP Java Encoder Project] is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies to help Java web developers defend against Cross Site Scripting.
−	* [https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project OWASP Java HTML Sanitizer Project] is a fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS.
−	* [https://www.owasp.org/index.php/OWASP_JSON_Sanitizer OWASP Java JSON Sanitizer] is a tool to convert JSON-like content to valid JSON! The OWASP JSON Sanitizer Project is a simple to use Java library that can be attached at either end of a data-pipeline
−	* [https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project OWASP AntiSamy] is a library for HTML and CSS encoding.
−
−	~~== XML Security ==~~
−	* The [http://santuario.apache.org/ Apache Santuario] project is aimed at providing implementation of the primary security standards for XML: XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.
−
−	~~== CSRF Defense ==~~
−	* The [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project CSRF Project] is a CSRF defense library that is integrated through the use of a JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML.
−
−	~~== Validation ==~~
−	* [http://www.sapia-oss.org/projects/vlad/home.html Vlad] stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
−
−	~~== Logging ==~~
−
−	* The [[OWASP Security Logging Project]] provides developers and ops personnel with APIs for logging security-related events.
−	~~<br>~~
−
−	~~[[Category:OWASP_Java_Project~~]]

@@ Line 33: / Line 33: @@
 == Logging ==
-* [[OWASP_Security_Logging_Project]] The OWASP Security Logging project provides developers and ops personnel with APIs for logging security-related events.
+* The  [[OWASP Security Logging Project]] provides developers and ops personnel with APIs for logging security-related events.
 <br>
 [[Category:OWASP_Java_Project]]

@@ Line 31: / Line 31: @@
 * [http://www.sapia-oss.org/projects/vlad/home.html Vlad] stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
 <br>
 [[Category:OWASP_Java_Project]]

@@ Line 2: / Line 2: @@
 ==Enterprise==
-* [http://shiro.apache.org/ Apache Shiro] is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
+* [http://shiro.apache.org/ Apache Shiro] is a Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
 * [http://projects.spring.io/spring-security/ Spring Security] provides comprehensive security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery. There is a particular emphasis on supporting projects built using the Spring Framework, but it is a powerful security solution for standard Java EE applications as well.
 * [[ESAPI|OWASP Enterprise Security API]] a new OWASP project to provide all essential security services under one roof.