Projects/OWASP EJSF Project - Revision history

Samuel Matthey Gil at 11:18, 2 September 2013

2013-09-02T11:18:39Z

Samuel Matthey Gil at 10:58, 2 September 2013

2013-09-02T10:58:30Z

Samuel Matthey Gil at 10:54, 2 September 2013

2013-09-02T10:54:41Z

Rakesh Kachhadiya at 18:11, 22 July 2013

2013-07-22T18:11:42Z

Rakesh Kachhadiya: Project

2013-06-27T21:04:32Z

Project

Rakesh Kachhadiya at 20:56, 27 June 2013

2013-06-27T20:56:42Z

Rakesh Kachhadiya: Role

2013-06-27T15:30:54Z

Role

Rakesh Kachhadiya: Change Role

2013-06-27T15:29:37Z

Change Role

Samantha Groves: Created page with "{{Template:Project About | project_name =OWASP EJSF Project | project_home_page =OWASP EJSF Project | project_description =Modern web application frameworks have made it easy ..."

2013-03-11T19:23:21Z

Created page with "{{Template:Project About | project_name =OWASP EJSF Project | project_home_page =OWASP EJSF Project | project_description =Modern web application frameworks have made it easy ..."

New page

{{Template:Project About
| project_name =OWASP EJSF Project
| project_home_page =OWASP EJSF Project
| project_description =Modern web application frameworks have made it easy to develop high quality web applications, but developing a secure application still requires programmers to possess a deep understanding of security vulnerabilities and attacks. Sometimes it is difficult for an experienced developer to find and eliminate all the vulnerabilities. This demo represents the JSF-ESAPI framework based on JSF2.0 and OWASP ESAPI. It helps developers write a secure and lower-risk JSF based on a web application with minimal configuration and without extensive prior knowledge of the web security. The figure below shows a complete integration of the JSF-ESAPI framework with JSF2.0 and ESAPI. It works as a middleware and consists of four important modules. ESAPI Validation is the first module which verifies the user input as given in the XSS prevention cheat sheet provided by OWASP. It consists of many user-defined validator tags and generates appropriate error messages if the user input is not valid. In this way it performs a strong validation.

There are also some tags available in the correspondence validators in ESAPI, and they also filter the XSS relevant code from the input. The file-based authorization module simplifies the user’s role, such as admin, user, etc. and gives the permission to visualize certain components at the presentation layer based on assigned roles. ESAPI Filtering layer compares the valid form token with tokens stored in the session for that user. If the token is mitigated or changed by man in the middle during the process of a request-response exchange, it will give the appropriate exception.

The last module is a render module, which renders the output after filtering the XSS content and encodes the vulnerable characters such as <,>,”,’ etc. as given in the XSS prevention cheat sheet provided by OWASP.

[JSF-ESAPI Complete Architecture]This framework will help developers to prevent a myriad of security problems including cross-site scripting, cross-site request forgery, automatic input validation, and automatic output validation with escaped “true” or without this parameter, authorization. All the features are included in one framework.

Advantages:-
(1) It requires minimal configuration to use the framework.
(2) It ensures retrofit security in the existing application.
(3) It provides the same performance as JSF framework.
(4) Automatic filtering of the XSS vulnerable code from output takes place when escape equals true” or “false”.
(5) The input validation is easy and no additional coding is required.
(6) It has a layered architecture. It uses what you need and leaves what you don’t need at the moment.
(7) One framework includes the most secure features."

| project_license =GNU GPL v3 License (allows commercial use, but requires that modifications to your code stay open source, thus prohibiting proprietary forks of your project)
| leader_name1 =Rakeshkumar Kachhadiya
| leader_email1 =Rakeshkumar.Kachhadiya@owasp.org
| mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp_ejsf_project
| project_road_map = https://www.owasp.org/index.php/Projects/OWASP_EJSF_Project/Roadmap
}}

@@ Line 19: / Line 19: @@
 (7) One framework includes the most secure features."
-= Downloads =
 | project_license =GNU GPL v3 License  (allows commercial use, but requires that modifications to your code stay open source, thus prohibiting proprietary forks of your project)
 | leader_name1 =Prof.Dr. Emmanual Benoist

@@ Line 24: / Line 24: @@
 | leader_email1 = emmanuel.benoist@bfh.ch
 | leader_email2 =Rakeshkumar.Kachhadiya@owasp.org
 | presentation_link = https://www.owasp.org/images/e/e6/AppSecEU2012_Benoist.pdf
 | mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp_ejsf_project
 | project_road_map = https://www.owasp.org/index.php/Projects/OWASP_EJSF_Project/Roadmap
 }}

@@ Line 20: / Line 20: @@
 | project_license =GNU GPL v3 License  (allows commercial use, but requires that modifications to your code stay open source, thus prohibiting proprietary forks of your project)
-| leader_name1 =Prof.Dr.Benoist
+| leader_name1 =Prof.Dr. Emmanual Benoist
 | leader_name2 = Rakeshkumar Kachhadiya
 | leader_email1 = emmanuel.benoist@bfh.ch

@@ Line 24: / Line 24: @@
 | leader_email1 = emmanuel.benoist@bfh.ch
 | leader_email2 =Rakeshkumar.Kachhadiya@owasp.org
 | mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp_ejsf_project
 | project_road_map = https://www.owasp.org/index.php/Projects/OWASP_EJSF_Project/Roadmap
 }}

@@ Line 22: / Line 22: @@
 | leader_name1 =Prof.Dr.Benoist
 | leader_name2 = Rakeshkumar Kachhadiya
-| leader_email1 = emmanuel.benoist@bfh.ch and emmanuel@benoist.ch
+| leader_email1 = emmanuel.benoist@bfh.ch
 | leader_email2 =Rakeshkumar.Kachhadiya@owasp.org
 | mailing_list_name = https://lists.owasp.org/mailman/listinfo/owasp_ejsf_project
 | project_road_map = https://www.owasp.org/index.php/Projects/OWASP_EJSF_Project/Roadmap
 }}

@@ Line 8: / Line 8: @@
 The last module is a render module, which renders the output after filtering the XSS content and encodes the vulnerable characters such as <,>,”,’ etc. as given in the XSS prevention cheat sheet provided by OWASP.
-[JSF-ESAPI Complete Architecture]This framework will help developers to prevent a myriad of security problems including cross-site scripting, cross-site request forgery, automatic input validation, and automatic output validation with escaped “true” or without this parameter, authorization. All the features are included in one framework.
+This framework will help developers to prevent a myriad of security problems including cross-site scripting, cross-site request forgery, automatic input validation, and automatic output validation with escaped “true” or without this parameter, authorization. All the features are included in one framework.
 Advantages:-