Java Server Faces - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T11:47:34Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

Kenneth Kron at 17:53, 23 May 2013

2013-05-23T17:53:31Z

Kenneth Kron at 17:50, 23 May 2013

2013-05-23T17:50:15Z

Shady: fix link

2013-05-12T18:07:28Z

fix link

KirstenS: /* ICE Faces */

2009-04-20T11:37:22Z

‎ICE Faces

KirstenS: /* ICE Faces */

2009-04-20T11:36:14Z

‎ICE Faces

KirstenS: /* MyFaces */

2009-04-20T11:35:11Z

‎MyFaces

KirstenS: /* JSF Standards and roles */

2009-04-20T11:32:19Z

‎JSF Standards and roles

Stephendv: /* Web security.. before you start */

2008-03-10T15:53:06Z

‎Web security.. before you start

Jeff Williams: /* MyFaces */

2008-01-15T21:30:31Z

‎MyFaces

← Older revision		Revision as of 11:47, 10 November 2017
Line 150:		Line 150:


−		+	[[Category:Java]]
−	[[Category:~~OWASP~~ Java ~~Project~~]]

@@ Line 87: / Line 87: @@
 ===ICE Faces===
-Starting from the idea that AJAX on Its Own Doesn't Corrupt Web Security ICE faces implements a component suite with ajax support by maintainig a coninus sync between the dom sent to the browser and a dom representation on the server. javascript is used to send commands to the server and invoke the logic in the java layer. Since dom model and javascript is involved a Javascript debugging  tool with value injection or dom injection capability could be of some use in pick locking the app.
+Starting from the idea that AJAX on Its Own Doesn't Corrupt Web Security ICE faces implements a component suite with ajax support by maintainig a continuous sync between the dom sent to the browser and a dom representation on the server. javascript is used to send commands to the server and invoke the logic in the java layer. Since dom model and javascript is involved a Javascript debugging  tool with value injection or dom injection capability could be of some use in pick locking the app.
-As stated in ICEFaces manual " the client is untrusted, SO DON'T TRUST IT!!" : it means that is all ups to the application designer to implement a robust security logic behind the scenes.
+As stated in ICEFaces manual " the client is untrusted, SO DON'T TRUST IT!!" : it means that is up to the application designer to implement a robust security logic behind the scenes.
 In another point of view the developer could focus on implementing server side security since with the server-side-dom architecture the thin client is even thinner.
-The component that refresh the two dom , caled IntervalRenderer, uses  a persistent ServletRequest stored on the server. Unfortunately, this request does not contain sufficient information to perform the isUserInRole() check.
+The component that refresh the two dom , called IntervalRenderer, uses  a persistent ServletRequest stored on the server. Unfortunately, this request does not contain sufficient information to perform the isUserInRole() check.
 This kind of check is possible only on stadar render request phase.

@@ Line 77: / Line 77: @@
      </context-param>
-You can find mre info at http://wiki.apache.org/myfaces/Secure_Your_Application
+You can find more info at http://wiki.apache.org/myfaces/Secure_Your_Application
 ===SUN Reference Implementation===

@@ Line 61: / Line 61: @@
 The MyFaces resource filter could be a source of threat. It is designed to expose resources from a jar file and could therefore, be considered, potentially dangerous. Note there aren't any claimed security flaws nor exploits in the resource filter, but the nature of this component makes it a good target for attackers. Since all it has to do is serve data it is recommended that a dispatcher be added to the filter mapping element. This should lower the possibility of an attacker successfully manipulating the server request.
-For more information see: http://myfaces.apache.org/tomahawk/extensionsFilter.htm[[Category:FIXME|link not working]]
+For more information see: http://myfaces.apache.org/tomahawk/extensionsFilter.html
 There is also an easy way to enable encryption when using ''client save state''

@@ Line 87: / Line 87: @@
 ===ICE Faces===
-Starting from the idea that AJAX on Its Own Doesn't Corrupt Web Security ICE faces implements a component suite with ajax support by maintainig a coninus sync between the dom sent to the browser and a dom rapresentation on the server. javascript is used to send commands to the server and invoke the logic in the java layer. Since dom model and javascript is involved a Javascript debugging  tool with value injection or dom injection capability could be of some use in pick loking the app.
+Starting from the idea that AJAX on Its Own Doesn't Corrupt Web Security ICE faces implements a component suite with ajax support by maintainig a coninus sync between the dom sent to the browser and a dom representation on the server. javascript is used to send commands to the server and invoke the logic in the java layer. Since dom model and javascript is involved a Javascript debugging  tool with value injection or dom injection capability could be of some use in pick locking the app.
 As stated in ICEFaces manual " the client is untrusted, SO DON'T TRUST IT!!" : it means that is all ups to the application designer to implement a robust security logic behind the scenes.
-In another point of view th developer could focus on implement server side security since with the server-side-dom architecture the thin client is even thinner.
+In another point of view the developer could focus on implementing server side security since with the server-side-dom architecture the thin client is even thinner.
-The component thath refresh the two dom , caled IntervalRenderer, uses  a persistent ServletRequest stored on the server. Unfortunately, this request does not contain sufficient information to perform the isUserInRole() check.
+The component that refresh the two dom , caled IntervalRenderer, uses  a persistent ServletRequest stored on the server. Unfortunately, this request does not contain sufficient information to perform the isUserInRole() check.
 This kind of check is possible only on stadar render request phase.

@@ Line 15: / Line 15: @@
 * Input validation
 * Value conversion
-These elements are defined by the JSF standard (JCP 127) so that any attacker will have knowledge of the architecture and life cycle of a JSF based application. JSF does not implement it's own security model but instead relies on standard JEE security. This means that both application server security model, JAAS or other ACL implementations can be used with the JSF framework without any integration effort. But Access Control is just one part of security - all aspects should be implemented in a secure manner in order to consider the application itself secure.
+These elements are defined by the JSF standard (JCP 127) so that any attacker will have knowledge of the architecture and life cycle of a JSF based application. JSF does not implement its own security model but instead relies on standard JEE security. This means that both application server security model, JAAS or other ACL implementations can be used with the JSF framework without any integration effort. But Access Control is just one part of security - all aspects should be implemented in a secure manner in order to consider the application itself secure.
 ==Client-side state saving==

@@ Line 1: / Line 1: @@
 ==Web security.. before you start ==
 This document is about security in web applications developed using the Java Server Faces (JSF) framework. The reader should be aware of the meaning of common terms of both JSF (converters, validators, managed beans) and web security (injection etc.)
 ==JSF Standards and roles==

@@ Line 63: / Line 63: @@
 There is also an easy way to enable encryption when using ''client save state''
-<context-param>
+    <context-param>
          <param-name>org.apache.myfaces.secret</param-name>
          <param-value>NzY1NDMyMTA=</param-value>
@@ Line 70: / Line 70: @@
 Supported encryption methods are BlowFish, 3DES, AES and are definde bya a context parameter
-<context-param>
+    <context-param>
          <param-name>org.apache.myfaces.algorithm</param-name>
          <param-value>Blowfish</param-value>