Scala Frameworks - Revision history

Johanna Curiel: /* Vulnerable Framework Components */

2017-11-07T13:34:47Z

‎Vulnerable Framework Components

2017-11-07T13:34:22Z

2017-11-07T13:07:08Z

2017-11-07T13:01:13Z

2017-11-07T07:11:01Z

‎Encryption Keystore Password

2017-11-07T07:09:00Z

2017-11-07T06:58:39Z

‎Configuration Keystore

2017-11-07T06:48:05Z

‎Configuration Keystore

2017-11-07T06:46:47Z

‎Play Framework

2017-11-07T06:45:52Z

‎Enabling SSL in Production

@@ Line 32: / Line 32: @@
 ==Vulnerable Framework Components==
-It is essential that developers implement regular dependency checks of their components, since must Scala projects will make use of the above mentioned frameworks. Consider using
+It is essential that developers implement regular dependency checks of their components, since most Scala projects will make use of the above mentioned frameworks. Consider using
 https://www.owasp.org/index.php/OWASP_Dependency_Check
 Which has a Scala plugin for this purpose

@@ Line 32: / Line 32: @@
 ==Vulnerable Framework Components==
-It is essential that developers implement regular dependency checks of their components, since must Scala projects will make use of the above mentioned frameworks
+It is essential that developers implement regular dependency checks of their components, since must Scala projects will make use of the above mentioned frameworks. Consider using
+https://www.owasp.org/index.php/OWASP_Dependency_Check
 ==Reference==
 https://www.47deg.com/blog/security-frameworks-for-scala/

← Older revision		Revision as of 13:07, 7 November 2017
Line 29:		Line 29:

	The following is a series of documents regarding the security configurations for the above mentioned frameworks		The following is a series of documents regarding the security configurations for the above mentioned frameworks
		+	https://www.owasp.org/index.php/Scala_Frameworks/Play

	==Vulnerable Framework Components==		==Vulnerable Framework Components==

@@ Line 26: / Line 26: @@
 |}
-==Play Framework==
+==Secure Coding - Scala Frameworks==
-Programers should avoid configuring clear text passwords  in Application.conf files, for that purpose, encryption is necessary
+The following is a series of documents regarding the security configurations for the above mentioned frameworks
 ==Vulnerable Framework Components==

@@ Line 57: / Line 57: @@
 ====Encryption Keystore Password====
 Following best practices, if you need to store a password, make sure that
--Is hashed
+* It's hashed
--Use salt
+* Use salt
--Implement a slow algorithm against brute force such as Bcrypt
+* Implement a slow algorithm against brute force such as Bcrypt The following example uses Bcrypt library for this purpose
   def PasswordHash( name:String, pwd:String, version:Int = 1 ) : String = {
      if( version == 2 && false )

@@ Line 56: / Line 56: @@
 ''Security issue'': Developer should check what is the 'defaults' being used and make sure the algorithm in question is secure as recommended by NIST guidelines
-====Encryption Keystore====
+====Encryption Keystore Password====
 === Enabling SSL in Production ===

← Older revision		Revision as of 06:58, 7 November 2017
Line 45:		Line 45:

	''Security issue'': Keys must be secure guarded, allowing the 'generated' one, can allow an attacker obtain such information if code is compromised		''Security issue'': Keys must be secure guarded, allowing the 'generated' one, can allow an attacker obtain such information if code is compromised
		+
		+	More information refer to: [[Cryptographic Storage Cheat Sheet\|Cryptographic Storage Cheat Sheet#Rule - Protect keys in a key vault]]

	'''play.server.https.keyStore.password''' - The password, defaults to a blank password		'''play.server.https.keyStore.password''' - The password, defaults to a blank password

@@ Line 39: / Line 39: @@
 The Playframework provides some examples of implementing [https://www.playframework.com/documentation/2.6.x/ConfiguringHttps#SSL-Certificates-from-a-keystore this]
 unfortunately, there is no further information on how to create this information securely. The developer must also keep in mind that the default configuration is quite insecure and certificates generated are self-signed, becoming unsuitable for real applications.
 '''play.server.https.keyStore.path''' - The path to the keystore containing the private key and certificate, if not provided generates a keystore for you

@@ Line 36: / Line 36: @@
 === Enabling SSL in Production===
-Play recommends to use JDK 1.8 which provides a number of new features that make JSSE feasible as a TLS termination layer
+[https://www.playframework.com/documentation/2.3.x/ConfiguringHttps Play recommends] to use JDK 1.8 which provides a number of new features that make JSSE feasible as a TLS termination layer
 ===Configuration Keystore  ===