Difference between revisions of "Category:Java"

Security Tools

Secure Coding Libraries

General Documents

A list of third party (i.e. not part of Java SE or EE) security frameworks. This page contains a list of Java security libraries and frameworks and indicates which security features each library supports.

Enterprise

• Apache Shiro is a Java security framework that performs authentication, authorization, cryptography, and session management.
• Spring Security provides security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery.
• HDIV A web application security framework that provides a number of functions.

Access Control (Authentication and Authorization)

• OACC is an application security framework for Java designed for fine grained (object level) access control. OACC uses the abstraction of a resource for the application objects being secured. This key abstraction enables OACC to provide a rich API that includes grant, revoke and query capabilities for storing and managing the application's security relationships.
• PicketLink provides authentication, single sign on, permission based access control and other security features.

Encryption

• Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys.
• Bouncycastle is a lightweight Java cryptography API provider.
• Jasypt is a Java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

XML Security

• The Apache Santuario project is aimed at providing implementation of the primary security standards for XML: XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Validation

• Vlad stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
• This OWASP article and code snippet proposes a way to protect a file upload feature against submission of files that may contain malicious code.
• The Apache Common's validator can be used to perform validation.

Mailing List

OWASP Java and JVM Technologies Mailing List

Code Repository

GitHub OWASP Global Repository

Related Project Resources

OWASP Project Repository

Languages Repository

.NET Project

Ruby Technology Knowledge Base

PHP Technology Knowledge Base

Perl Technology Knowledge Base

Python Technology Knowledge Base

JavaScript Technology Knowledge Base

C/C++ Technology Knowledge Base

SQL, PL/SQL and DB Scripting Technology Knowledge Base

OWASP IoT Security Project

OWASP Mobile Security Project

Roadmap

• Build Java and JVM security related net resources guide
• The OWASP Java and JVM Technology Knowledge Base is principally about creating deep, rich guidance for Java and JVM developers using all kind of security resources. The idea is to have an effort of building a internet resource guide for everything around the JVM universe. Information, blogs, articles, tools, test servers and more. Important however is that this list is seriously curated.
• Concrete guideline for Java and JVM developers
• Clear checklists, around various topics, language, servers and frameworks.

The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.

When it comes to participating in project activities, everything depends on the time you are willing and able to invest. It is however very important to not jump into too many things at the beginning, later having to back out or to let unfinished things behind you. It is much better to start with small tasks, increasing intensity and investment over time.

Please also be patient with expecting the "merge" of your work into the existing project pages and code. As everywhere in live, trust has to be built-up.

The Java and JVM knowledge base has currently multiple tasks open, which can be found on the adequate section of this page. Not all tasks require a wiki account. Please take something you are interested in and start participating. Work load is not the only outcome when participating in open projects. You are getting a lot of things back: recognition, satisfaction, knowledge and contacts, sometime friends.

Sounds cool? Then jump in...

To get involved join the mailing list, follow this link: OWASP Java and JVM Mailing List

The previous version of this JAVA Project home page is archived here: OWASP Java Project Archive (8.2010)