Scala Frameworks/Play - Revision history

Johanna Curiel at 10:50, 19 November 2017

2017-11-19T10:50:51Z

Johanna Curiel at 10:48, 19 November 2017

2017-11-19T10:48:41Z

Johanna Curiel: /* Security Features */

2017-11-19T08:24:59Z

‎Security Features

Johanna Curiel at 16:50, 14 November 2017

2017-11-14T16:50:14Z

Johanna Curiel at 12:14, 14 November 2017

2017-11-14T12:14:24Z

Johanna Curiel: /* Encryption Keystore Password */

2017-11-14T11:27:42Z

‎Encryption Keystore Password

Johanna Curiel: /* Enabling SSL in Production */

2017-11-07T16:52:21Z

‎Enabling SSL in Production

Johanna Curiel at 16:49, 7 November 2017

2017-11-07T16:49:23Z

Johanna Curiel at 13:06, 7 November 2017

2017-11-07T13:06:22Z

Johanna Curiel: Created page with "==Play Framework== ===Sensitive information in Configuration Files=== Every Scala project will contain configuration files that can contain sensitive information such as: *Pas..."

2017-11-07T13:02:12Z

Created page with "==Play Framework== ===Sensitive information in Configuration Files=== Every Scala project will contain configuration files that can contain sensitive information such as: *Pas..."

New page

==Play Framework==
===Sensitive information in Configuration Files===
Every Scala project will contain configuration files that can contain sensitive information such as:
*Passwords in clear text
*Path to Keystores
*Passwords from Keystores
Programers should avoid configuring clear text passwords in Application.conf files, for that purpose, encryption is necessary
===Configuration Keystore===
At some point, especially for projects requiring secure communications (HTTPS), the implementation and use of Keystore is required. The Playframework provides some examples of implementing [https://www.playframework.com/documentation/2.6.x/ConfiguringHttps#SSL-Certificates-from-a-keystore this] unfortunately, there is no further information on how to create this information securely. The developer must also keep in mind that the default configuration is quite insecure and certificates generated are self-signed, becoming unsuitable for real applications.

Developers should revise the following configuration information:

'''play.server.https.keyStore.path''' - The path to the keystore containing the private key and certificate, if not provided generates a keystore for you

''Security issue'': Keys must be secure guarded, allowing the 'generated' one, can allow an attacker obtain such information if code is compromised

More information refer to: [[Cryptographic Storage Cheat Sheet|Cryptographic Storage Cheat Sheet#Rule - Protect keys in a key vault]]

'''play.server.https.keyStore.password''' - The password, defaults to a blank password

''Security issue'': Blank passwords are a 'no-go', therefore, it is essential to change this information. Again, do not create a 'clear-text' passwords, but make sure you use an environment variable for this purpose, or encrypt properly if you place one in the configuration file

'''play.server.https.keyStore.algorithm''' - The key store algorithm, defaults to the platforms default algorithm

''Security issue'': Developer should check what is the 'defaults' being used and make sure the algorithm in question is secure as recommended by NIST guidelines
====Encryption Keystore Password====
Using Environment in configuration files instead of clear text passwords, example
<code>password=${?MAIL_PASSWD}</code>
Following best practices, if you need to store a password, make sure that
*It's hashed
*Use salt
*Implement a slow algorithm against brute force such as Bcrypt The following example uses Bcrypt library for this purpose
def PasswordHash( name:String, pwd:String, version:Int = 1 ) : String = { if( version == 2 && false ) { // ANY CHANGES SHOULD BE MADE AS A NEW VERSION AND ADDED HERE "" } else { import org.mindrot.jbcrypt.BCrypt // jbcrypt-0.3m.jar // Salt will be incorporated in the password hash val salt = BCrypt.gensalt(12) // Default is 10, or 2**10 rounds. More rounds is slower. BCrypt.hashpw( (name + pwd), salt ) } } def VerifyPassword( name:String, pwd:String, hash:String, version:Int = 1 ) : Boolean = { if( version == 1 ) { import org.mindrot.jbcrypt.BCrypt // jbcrypt-0.3m.jar BCrypt.checkpw( (name + pwd), hash ) } else false }
===Enabling SSL in Production===
[https://www.playframework.com/documentation/2.3.x/ConfiguringHttps Play recommends] to use JDK 1.8 which provides a number of new features that make JSSE feasible as a TLS termination layer

← Older revision		Revision as of 10:50, 19 November 2017
Line 48:		Line 48:
	Extending Security		Extending Security

−	There are different frameworks supporting Play with granular security features. For more information, please check the [[Scala Security Frameworks]]	+	There are different frameworks supporting Play with granular security features. For more information, please check the [[:Category:Scala\|Scala Security Frameworks]]

← Older revision		Revision as of 10:48, 19 November 2017
Line 46:		Line 46:
	* CRSF Token		* CRSF Token
	* [https://www.playframework.com/documentation/2.6.x/ScalaCsrf#Plays-CSRF-protection Security Headers]		* [https://www.playframework.com/documentation/2.6.x/ScalaCsrf#Plays-CSRF-protection Security Headers]
		+	Extending Security
		+
		+	There are different frameworks supporting Play with granular security features. For more information, please check the [[Scala Security Frameworks]]

@@ Line 42: / Line 42: @@
 === Security Features ===
-The Play framework contains some essential security features, the following is a guide map to them
+The Play framework contains some essential security features, the following is a guide map to them. This is valid for version 2.6.x
-{| class="wikitable"
+* Input Validation
-!Security feature
+* CRSF Token
-! rowspan="4" |
+* [https://www.playframework.com/documentation/2.6.x/ScalaCsrf#Plays-CSRF-protection Security Headers]

← Older revision		Revision as of 12:14, 14 November 2017
Line 40:		Line 40:
	===Enabling SSL in Production===		===Enabling SSL in Production===
	[https://www.playframework.com/documentation/2.3.x/ConfiguringHttps Play recommends] to use the latest JDK , at the moment of writing is 1.8, which provides a number of new features that make JSSE feasible as a TLS termination layer.		[https://www.playframework.com/documentation/2.3.x/ConfiguringHttps Play recommends] to use the latest JDK , at the moment of writing is 1.8, which provides a number of new features that make JSSE feasible as a TLS termination layer.
		+
		+	=== Security Features ===
		+	The Play framework contains some essential security features, the following is a guide map to them
		+	{\| class="wikitable"
		+	!Security feature
		+	! rowspan="4" \|
		+	!Guidelines for implementation
		+	!
		+	!
		+	\|-
		+	\|Input Validation
		+	\|
		+	\|
		+	\|
		+	\|-
		+	\|CRSF Token
		+	\|
		+	\|
		+	\|
		+	\|-
		+	\|Encryption
		+	\|
		+	\|
		+	\|
		+	\|}

@@ Line 1: / Line 1: @@
 ==Play Framework==
-The Playframework has excellent documentation on many topics, however when it touches security, documentation is quite limited regarding how to implementations. Documentation refers to the latest version
+The Playframework has excellent documentation on many topics, however when it touches security, this section is quite limited regarding how to do secure implementations.
+Documentation refers to the latest version.For more information please check:
 https://www.playframework.com/documentation/2.6.x/Home
-for more information please check
+The following sections contain some important security aspects to be considered while implementing certain configurations and features.
 ===Sensitive information in Configuration Files===

@@ Line 37: / Line 37: @@
 *Use salt
 *Implement a slow algorithm against brute force such as Bcrypt The following example uses Bcrypt library for this purpose
-  def PasswordHash( name:String, pwd:String, version:Int = 1 ) : String = {   if( version == 2 && false )                         {     // ANY CHANGES SHOULD BE MADE AS A NEW VERSION AND ADDED HERE     ""   }                                                       else   {     import org.mindrot.jbcrypt.BCrypt      // jbcrypt-0.3m.jar                                                         // Salt will be incorporated in the password hash                                                                                val salt = BCrypt.gensalt(12) // Default is 10, or 2**10 rounds.  More rounds is slower.                                BCrypt.hashpw( (name + pwd), salt )   } }                                                                                     def VerifyPassword( name:String, pwd:String, hash:String, version:Int = 1 ) : Boolean = {   if( version == 1 )                      {     import org.mindrot.jbcrypt.BCrypt      // jbcrypt-0.3m.jar     BCrypt.checkpw( (name + pwd), hash )   }                 else                                                                                                                             false }
+  def PasswordHash( name:String, pwd:String, version:Int = 1 ) : String = {   if( version == 2 && false )                                                               {     // ANY CHANGES SHOULD BE MADE AS A NEW VERSION AND ADDED HERE     ""   }                                                                                    else   {     import org.mindrot.jbcrypt.BCrypt      // jbcrypt-0.3m.jar                                                                                             // Salt will be incorporated in the password hash                                                                                                                    val salt = BCrypt.gensalt(12) // Default is 10, or 2**10 rounds.  More rounds is slower.                                                                    BCrypt.hashpw( (name + pwd), salt )   } }                                                                                                                           def VerifyPassword( name:String, pwd:String, hash:String, version:Int = 1 ) : Boolean = {   if( version == 1 )                                                       {     import org.mindrot.jbcrypt.BCrypt                                                                                                                              // jbcrypt-0.3m.jar                                                                                                                                         BCrypt.checkpw( (name + pwd), hash )   }                                                                                                                             else                                                                                                                                                                false }
 ===Enabling SSL in Production===
 [https://www.playframework.com/documentation/2.3.x/ConfiguringHttps Play recommends] to use the latest JDK , at the moment of writing is 1.8, which provides a number of new features that make JSSE feasible as a TLS termination layer.